Troj/Mbroot-A includes functionality to access the internet and communicate with a remote server via HTTP.
When Troj/Mbroot-A is installed it creates the file <Temp>\cln2.tmp. The file cln2.tmp is detected as Mal/Sinowa-A.
Sophos's anti-virus products include Behavioral Genotype" Protection,which can proactively guard against new threats without requiring an update. Sophos customers have been protected against Troj/Mbroot-A (detected as Mal/Sinowa-A) since version 4.25.