Troj/Abox-A

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entries. The removal of these entries is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ABox = "C:\\WINDOWS\\ABox.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinLogon = "C:\\WINDOWS\\logon.exe"

and delete them if they exist.

Close the registry editor.

Troj/Abox-A is a downloading Trojan.

The Trojan writes an ftp script to a file in the Windows temporary folder. The script is then executed, resulting in the following files being downloaded to the Windows folder:

abox.exe
logon.exe
update.exe
logon.txt
abox.bup

At the time of writing, the EXE files are all detected as Troj/Abox-A while the other two files are harmless.

Troj/Abox-A creates the following registry entries so that the downloaded files are run during login:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
ABox = "C:\\WINDOWS\\ABox.exe"

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WinLogon = "C:\\WINDOWS\\logon.exe"

The Trojan also creates the following key and several entries below it for its own use:

HKLM\Software\Carmen\

Troj/Abox-A may periodically transmit information about the infected computer via HTTP forms.