high
Summary
Summary
Action- More Information
| Detected by | All Sophos products |
|---|---|
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Please follow the instructions for removing Trojans.
Windows NT/2000/XP
In Windows NT/2000/XP you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft auto update = WUAUCLT.EXE
and delete it if it exists.
Close the registry editor.
More Information
Troj/Cult-B is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.
Each time the Trojan is run it tries to connect to a remote IRC server and join a specific channel. The Trojan then runs in the background as a server process, listening for commands to execute.
When first run the Trojan copies itself to the Windows System folder as WUAUCLT.EXE and creates the following registry entry so that WUAUCLT.EXE is run automatically each time Windows is started:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft auto update = WUAUCLT.EXE
|
