high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 30 March 2005 21:32:56 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bdoor-CPK is a backdoor Trojan.
When run, Troj/Bdoor-CPK will drop a DLL with an extension of DAT. The DLL file is also detected as Troj/Bdoor-CPK.
In order to run automatically each time Internet Explorer is started, Troj/Bdoor-CPK sets the following registry entries:
HKCR\CLSID\{1C044AAD-7955-4cbd-8175-501A165C4E5D}\InprocServer32
(default)
<path to Trojan DLL>
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1C044AAD-7955-4cbd-8175-501A165C4E5D}
In order to run automatically each time the computer starts or shuts down, Troj/Bdoor-CPK will set the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Trojan filename>
Asynchronous
1
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Trojan filename>
DllName
<path to Trojan DLL>
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Trojan filename>
Logon
MachineLogon
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\<Trojan filename>
Logoff
MachineLogoff
|
