high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | December 2006 (4.12) |
| Protection available since | 25 October 2006 21:43:15 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/SpamThru-K is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
Troj/SpamThru-K can be used to send unsolicited emails as specified by a remote user. Troj/SpamThru-K is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.
Troj/SpamThru-K can be used to send unsolicited emails as specified by a remote user.
The following registry entry is created to run Troj/SpamThru-K on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Explorer 2238
<pathname of the Trojan executable>
The following registry entries are created to run code exported by the Trojan libraries on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\SharedTaskScheduler
{2C1CD3D7-86AC-4068-93BC-A02304BB2238}
DCOM Server 2238
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
DCOM Server 2238
{2C1CD3D7-86AC-4068-93BC-A02304BB2238}
The Troj/SpamThru-K is registered as a COM object, creating registry entries under:
HKCR\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304BB2238}
|
