high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Included in our products from | October 2007 (4.22) |
| Protection available since | 19 August 2007 07:36:38 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/SpamToo-AW is a spamming Trojan tool for the Windows platform.
When run Troj/SpamToo-AW runs and sets up the default Microsoft service "Windows Socket 2.0 Non-IFS Service Provider Support Environment". Registry entries may be created under:
HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL\
Once installed Troj/SpamToo-AW creates the file <System>\rsvp322.dll.
Troj/SpamToo-AW then proceeds to create multiple duplicate copies of the file <System>\rsvp322.dll as <System>\rsvp322.dll<random characters>. These files are detected as Troj/SpamToo-AR.
Troj/SpamToo-AW also creates the file <System>\sporder.dll. This file is not malicious.
Troj/SpamToo-AW provides functionality to act as an email spam proxy.
|
