high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Protection available since | 27 July 2005 22:09:29 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Cosiam-C is a proxy Trojan with backdoor capabilities.
Troj/Cosiam-C will contact a remote location in order to report details of the infected computer, including the port that the Trojan is listening on, the computer's IP and operating system. The Trojan may then download configuration data.
Troj/Cosiam-C is capable of downloading and running further executable files.
When first run, Troj/Cosiam-C will copy itself to the Windows system folder as outpostupdate.exe. In order to run automatically each time a user logs in, Troj/Cosiam-C will set the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
outpostupdate
<Windows system folder>\outpostupdate.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
outpostupdate
<Windows system folder>\outpostupdate.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
outpostupdate
<Windows system folder>\outpostupdate.exe
Troj/Cosiam-C creates the following registry entry:
HKLM\SOFTWARE\Microsoft\ATI_VER
The Trojan is capable of performing Denial of Service (DoS) attacks on remote computers.
|
