high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 13 December 2005 22:28:43 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/FireFly-A is a Trojan for the Windows platform.
When first run Troj/FireFly-A copies itself to <Program Files>\FireFly\WinDeBug.exe and creates the following files:
<Current Folder>\Delme.bat
<Program Files>\FireFly\FireFlyInfo.ini
The file Delme.bat is a clean batch file used to delete Troj/FireFly-A. The file FireFlyInfo.ini is a clean configuration file.
The file WinDeBug.exe is registered as a new system driver service named "FireFly", with a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\FireFly\
Troj/FireFly-A attempts to connect to a remote server and may download and execute a file from a remote location. Files may be downloaded to the following locations:
<Program Files>\FireFly\Serpent.Exe
<Program Files>\FireFly\ExeServer.Dat
|
