Troj/Small-UW

Category: Viruses and Spyware
Type: Trojan
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Small-UW is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.

When first run Troj/Small-UW moves itself to the Windows system folder as svcnxp32.exe and creates the following new registry entry, so that svcnxp32.exe is run automatically on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WindowsXPserv = svcnxp32.exe

Whilst the Trojan is active it refreshes this registry entry every 1 second in an attempt to prevent its deletion.

Troj/Small-UW tries to connect to a remote IRC server on port 6667 using a random nickname and join a specific channel.

The Trojan then listens on the channel for instructions specified by a remote intruder. A remote intruder can instruct the Trojan to carry out various actions such as download and run new executable files.

download Try Sophos products for free
Download now