Troj/PWS-ANG is a Trojan for the Windows platform.
When run, the Trojan creates the following files:
<Temp>\expseny.exe
<Temp>\geq.dll
<Temp>\npptools.dll
<Temp>\Packet.dll
<Temp>\WanPacket.dll
<System>\drivers\npf.sys
The files expseny.exe and geq.dll are detected as Mal/EncPk-F. The files npf.sys, npptools.dll, Packet.dll and WanPacket.dll are not malicious
When run the Trojan sets the following registry entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
svc
<Temp>\expseny.exe
The Trojan sets registry entries under:
HKLM\SYSTEM\CurrentControlSet\Services\NPF