Troj/SpamToo-AW is a spamming Trojan tool for the Windows platform.
When run Troj/SpamToo-AW runs and sets up the default Microsoft service "Windows Socket 2.0 Non-IFS Service Provider Support Environment". Registry entries may be created under:
HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL\
Once installed Troj/SpamToo-AW creates the file <System>\rsvp322.dll.
Troj/SpamToo-AW then proceeds to create multiple duplicate copies of the file <System>\rsvp322.dll as <System>\rsvp322.dll<random characters>. These files are detected as Troj/SpamToo-AR.
Troj/SpamToo-AW also creates the file <System>\sporder.dll. This file is not malicious.
Troj/SpamToo-AW provides functionality to act as an email spam proxy.