Troj/Dloader-UQ

Please follow the instructions for removing Trojans.

Troj/Dloader-UQ is a Trojan for the Windows platform.

Troj/Dloader-UQ includes functionality to access the internet and communicate
with a remote server via HTTP.

When first run Troj/Dloader-UQ copies itself to:

<Windows<\osrss.exe
<System<\coniem.exe

The following registry entry is created to run osrss.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ctfnom.exe
<Windows<\OSRSS.exe

The following registry entry is set or modified, so that coniem.exe is run when
files with extensions of TXT are opened/launched:

HKCR\txtfile\shell\open\command
(default)
<System<\CONIEM.exe "%1"

Troj/Dloader-UQ changes the Start Page for Microsoft Internet Explorer by
setting the registry entry:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page

The following registry entries are set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system
DisableTaskMgr
1

HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
HomePage
1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden
SHOWALL
CheckedValue
0