Sophos

Sophos blogs

Troj/BHO-FE

Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 7 April 2008 16:09:54 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/BHO-FE is a Trojan for the Windows platform.

When Troj/BHO-FE is installed the following files are created:

<Windows>\TinyBHO.dll
<Windows>\fetchuserid.exe

The file TinyBHO.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9803b12-f0a0-11dc-95ff-0800200c9a66}
HKCR\CLSID\{c9803b12-f0a0-11dc-95ff-0800200c9a66}
HKCR\Interface\{9B871243-2983-495D-9FEB-D7059D0E8056}
HKCR\TypeLib\{7CD37F36-0BEF-11DC-8314-0800200C9A66}

Registry entries are set as follows:

HKCR\SBBho.SBBho.1\CLSID
(default)
{c9803b12-f0a0-11dc-95ff-0800200c9a66}

HKCR\SBBho.SBBho\CLSID
(default)
{c9803b12-f0a0-11dc-95ff-0800200c9a66}

Registry entries are created under:

HKCU\Software\BHO
HKCR\SBBho.SBBho

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer