high
Summary
Summary
Action- More Information
| Protection available since | 2 July 2004 08:26:38 (GMT) |
|---|---|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dloader-MB is a Trojan downloader.
In order to run automatically when Windows starts up the Trojan copies
itself to the file mcc.exe in the Windows system folder and adds the following
registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Multimedia Codecs
= C:\Windows\System32\mcc.exe
Troj/Dloader-MB downloads a text file from a preconfigured URL to links.tmp in
the Windows temporary folder. The Trojan then registers itself as a service
process and periodically performs actions listed in the downloaded file. These
actions can be either URLs (which are opened in Internet Explorer) or
arbitrary commands.
Troj/Dloader-MB also creates a set of registry entries for its own use beneath
HKCU\Software\Media Codecs\DDMMYYYY\
(where DDMMYYYY represents the date on which the Trojan was run)
|
