Troj/Xorpix-F is a proxy Trojan that allows a remote attacker to route network traffic through the infected computer.
Troj/Xorpix-F is a proxy Trojan that allows a remote attacker to route network traffic through the infected computer.
When Troj/Xorpix-F is installed it creates the file <User>\Documents\Settings\arm32.dll. This file is also detected as Troj/Xorpix-F.
The following registry entries are created to run code exported by arm32.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg
DllName
<User>\Documents\Settings\arm32.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg
Startup
arm32reg
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg
Impersonate
1