Troj/SpamToo-AO is a spamming Trojan tool for the Windows platform.
When run Troj/SpamToo-AO runs and sets up the default Microsoft service "Windows Socket 2.0 Non-IFS Service Provider Support Environment". Registry entries may be created under:
HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL\
Once installed Troj/SpamToo-AO creates the file <System>\rsvp322.dll.
Troj/SpamToo-AO then proceeds to create multiple duplicate copies of the file <System>\rsvp322.dll as <System>\rsvp322.dll<random characters>. These files are also detected as Troj/SpamToo-AO.
Troj/SpamToo-AO also creates the file <System>\sporder.dll. This file is not malicious.
Troj/SpamToo-AO provides functionality to act as an email spam proxy.