Troj/SpamToo-AM is a spamming Trojan tool for the Windows platform.
When run Troj/SpamToo-AM runs and sets up the default Microsoft service "Windows Socket 2.0 Non-IFS Service Provider Support Environment". Registry entries may be created under:
HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL\
Once installed Troj/SpamToo-AM creates the file <System>\rsvp322.dll.
Troj/SpamToo-AM then proceeds to create multiple duplicate copies of the file <System>\rsvp322.dll as <System>\rsvp322.dll<random characters>. These files are also detected as Troj/SpamToo-AM.
Troj/SpamToo-AM also creates the file <System>\sporder.dll. This file is not malicious.
Troj/SpamToo-AM provides functionality to act as an email spam proxy.