Troj/GDoor-R

Please follow the instructions for removing Trojans.

Please contact technical support.

Troj/GDoor-R is a backdoor Trojan.

Troj/GDoor-R will listen on the default port of 7626 for a connection from a remote backdoor client.

Troj/GDoor-R will copy itself to the Windows system folder as KERNEL32.EXE and SYSEXPLR.EXE. In order to run automatically each time a user logs on, Troj/GDoor-R will set the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
(Default)
<Windows system folder>\KERNEL32.EXE

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
(Default)
<Windows system folder>\KERNEL32.EXE

Troj/GDoor-R will associate itself with the opening of text files by setting the following registry entry:

HKCR\txtfile\Shell\open\command
(Default)
<Windows system folder>\SYSEXPLR.EXE %1

Troj/GDoor-R may also set the following registry entries in an attempt to run itself each time an executable file is run:

HKCR\exefile\Shell\open\command
(Default)
<Windows system folder>\SYSEXPLR.EXE %1

HKCR\exefile\Shell\run\command
(Default)
<Windows system folder>\SYSEXPLR.EXE %1

Troj/GDoor-R may attempt to disable registry editing tools by setting the following registry entry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableRegistryTools
1

Troj/GDoor-R will attempt to modify automatic connection settings by setting the following registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
EnableAutodisconnect
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
EnableAutodial
0

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
EnableAutodisconnect
0