Troj/Bckdr-CKB

Aliases	BackDoor-CKA Backdoor.Win32.Bifrose.at
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Protection available since	2 July 2005 15:20:04 (GMT)
Detected by	All Sophos products

Sophos beta program
Register now for our latest beta tests

Troj/Bckdr-CKB is a backdoor Trojan for the Windows platform.

When first run Troj/Bckdr-CKB copies itself to <System>\jusched32.exe and creates the file <System>\plugin1.dat.

The following registry entries are created to run jusched32.exe on startup:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\
{9B71D88C-C598-4935-C5D1-43AA4DB90836}
stubpath
<System>\jusched32.exe s

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
JavaUpdateSched
<System>\jusched32.exe

Registry entries are created under:

HKCU\Software\Wget\

Get reports about the latest virus and spyware threats delivered to your computer