Troj/SpamToo-AX is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
When Troj/SpamToo-AX is installed it creates the file <System>\drivers\protect.sys.
The file protect.sys is detected as Troj/NTRootK-CG.
The file protect.sys is registered as a new system driver service named "protect", with a display name of "protect". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\protect
Sophos's anti-virus products include
Behavioral Genotype® Protection, which can proactively guard against new threats without requiring an update. Sophos customers have been protected against Troj/SpamToo-AX (detected as Mal/Behav-104) since version 4.17.