high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | August 2007 (4.20) |
| Protection available since | 17 June 2007 06:50:08 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/IRCBot-WL is an IRC backdoor Trojan for the Windows platform.
When run Troj/IRCBot-WL creates the files:
<Windows>\photos.zip - detected as Troj/IRCBot-WL
<System>\syshelps.dll - detected as Troj/IRCBot-WL
The following registry entry is created to run code exported by (07A01ECF-9D28-4B9C-A4D0-E439D416517F) on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
syshelps
(07A01ECF-9D28-4B9C-A4D0-E439D416517F)
The file syshelps.dll is registered as a COM object, creating registry entries under:
HKCR\CLSID\(07A01ECF-9D28-4B9C-A4D0-E439D416517F)
|
