high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 30 June 2006 20:55:29 (GMT) |
| Last updated | 18 October 2006 22:51:52 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bdoor-DIJ is a proxy Trojan for the Windows platform.
The Trojan installs a Socks4 proxy server and contacts a remote site to report the infection and availability of the proxy server.
When first run the Trojan copies itself to the Windows folder as RavMonE.exe and sets the following registry entry in order to run each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
RavAV
"<Windows>\RavMonE.exe"
Troj/Bdoor-DIJ may attempt to copy the following files to mapped drives:
RavMonE.exe
autorun.inf
msvcr71.dll
RavMonE.exe is a copy of Troj/Bdoor-DIJ
Msvcr71.dll is a clean DLL file.
Autorun.inf attempts to launch the Trojan when the mapped drive is accessed.
|
