high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 4 September 2004 11:59:17 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dloader-BW attempts to download and execute EXE files from remote websites to the Windows system folder as intron.exe, ir.exe, lpt.exe and usb.exe.
The Trojan copies itself to the Windows system folder as twink64.exe and creates the following registry entry to run itself on system logon:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
ControlPanel = <Windows system>\twink64.exe internat.dll,LoadKeyboardProfile
|
