high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 3 November 2009 15:12:23 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bifrose-ZB is a Trojan for the Windows platform.
When first run, Troj/Bifrose-ZB copies itself to the following location:
<System>\regscr32.exe
The following registry entries are created to start Troj/Bifrose-ZB automatically when Windows starts:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Server Registry
<System>\regscr32.exe
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Server Registry
<System>\regscr32.exe
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{9B71D88C-C598-4935-C5D1-43AA4DB90836}
stubpath
<System>\regscr32.exe s
Troj/Bifrose-ZB attempts to connect to external websites, and may cause Internet Explorer to crash. If BOPS is enabled, Buffer Overflow warnings will be triggered.
Members of the Bifrose family typically create a backdoor on an infected computer, allowing an attacker to connect to the computer from the Internet.
Troj/Bifrose-ZB has been seen sent out within an RTF document file (eg support-form.doc) in a spam campaign with subject lines similar to the following:
Subject: Nonrefundable loan approved for your company!
These emails claim to be part of an Australian government program for business development.
|
