Sophos

Troj/Haxdoor-DT

Aliases
  • BackDoor-BAC.dr
  • trojan
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Included in our products from October 2006 (4.10)
Protection available since 17 August 2006 09:10:00 (GMT)
Detected by All Sophos products

Action

More Information

Troj/Haxdoor-DT is a Trojan for the Windows platform.

When Troj/Haxdoor-DT is installed the following files are created:

<System>\kgctini.dat
<System>\lps.dat
<System>\qo.dll
<System>\qo.sys
<System>\xdpptp.sys
<System>\xopptp.dll
<System>\xopptp.sys

The files qo.dll, qo.sys, xdpptp.sys, xopptp.dll and xopptp.sys are detected as Troj/Haxdor-Fam. The file lps.dat is a clean file and can be deleted.

The following registry entries are created to run code exported by xopptp.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xopptp
DllName
xopptp.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xopptp
Startup
ERU03Sbfex

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xopptp
Impersonate
1

The file xdpptp.sys is registered as a new system driver service named "xdpptp", with a display name of "YVPB video output". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\xdpptp\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer