Sophos

Sophos blogs

Troj/BluEye-D

Aliases
  • Trojan-Spy.Win32.Agent.t
  • W32/PWStealer.Z
  • W32/Agent.AY
  • PWS-IT
  • trojan
  • PWS-IT.kit
  • trojan
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 17 December 2005 15:28:09 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/BluEye-D is a Backdoor generator toolkit. It is capable of recording keystrokes and opening a backdoor to allow access to the command shell on victim's computer. The keystrokes will be saved in a log file which an intruder can access via the backdoor.

When first run Troj/BluEye-D copies itself to:

<System>\msvchost.exe
<System>\ssvchost.com

and creates the following files:

\<filename>.cab
<System>\regc64.dll

The following registry entry is set to run ssvchost.com on startup:

HKLM\SOFTWARE\Microsoft\ActiveSetup\Installed Components\<CLSID>
StubPath
<System>\ssvchost.com

Registry entries are created under:

HKLM\SOFTWARE\LolLol\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer