high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | September 2007 (4.21) |
| Protection available since | 20 July 2007 19:01:58 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/DwnLdr-GWX is a Trojan for the Windows platform.
Troj/DwnLdr-GWX includes functionality to access the internet and communicate with a remote server via HTTP.
When Troj/DwnLdr-GWX is installed the following files are created:
<Favorites>\ÊÕ²Ø.url
<System>\0m1df.dll
<System>\drivers\55euf6.sys
<System>\drivers\a6fyts35.sys
The file 55euf6.sys is registered as a new system driver service named "55euf6", with a display name of "55euf6". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\55euf6
The file a6fyts35.sys is registered as a new system driver service named "a6fyts35", with a display name of "a6fyts35" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\a6fyts35
Registry entries are created under:
HKLM\SOFTWARE\Microsoft\IE4
|
