high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Protection available since | 22 December 2005 07:07:52 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/DownLdr-IM is a Trojan for the Windows platform.
Troj/DownLdr-IM includes functionality to download, install and run new software.
When first run Troj/DownLdr-IM copies itself to <System>\chkdisk32.exe and repeatedly tries to download a file from a remote url to the Windows temp folder with a name dl<random numbers>.exe.
Troj/DownLdr-IM will create the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Disk check
"chkdisk32.exe"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Disk check
"chkdisk32.exe"
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Disk check
"chkdisk32.exe"
|
