Troj/KillJWS-A is a Trojan for the Windows platform. The Trojan targets the software commonly used for Windows accessibility by blind people. The Trojan is reportedly distributed as a crack program for the popular screen reader program JAWS version 9.
Troj/KillJWS-A is a Trojan for the Windows platform.
When Troj/KillJWS-A is installed the following files are created:
<Windows>\config\svchost.exe
<Windows>\mci32.exe
<System>\securityService.dll
The following registry entries are created to run code exported by securityService.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\securityService
DllName
securityService.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\securityService
impersonate
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\securityService
Startup
startup
After 26 December 2007 Troj/KillJWS-A will terminate the following processes related to popular speech synthesis and speech recognition software:
jfw.exe
hal.exe
narrator.exe
wineyes
speech32
gwm32
kurzweil