Troj/Small-ELY is a proxy Trojan for the Windows platform.
When run Troj/Small-ELY copies itself to <Windows>\services.exe and sets the following registry entries:
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4
HKLM\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
HKLM\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
services
<Windows>\services.exe
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0
HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc
Start
4
Registry entries may also be created under:
HKCU\Software\Microsoft\Internet Explorer\Desktop