high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 2 November 2005 18:13:09 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Hasum-A is a Trojan for the Windows platform.
Troj/Hasum-A may download and run files from a remote server, may open the default browser to pre-specified webapges, and may monitor computer usage.
The following registry entries are created to run code exported by the Trojan DLL on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i
DLLName
<pathname of the Trojan executable>
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3i
startup
WACLEventStartup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
{B212D577-05B7-4963-911E-4A8588160DFA}
st3i
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3
DLLName
<pathname of the Trojan DLL>
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\st3
startup
WACLEventStartup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ SharedTaskScheduler
{1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5}
z
Troj/Hasum-A is registered as a COM object, creating registry entries under:
HKCR\CLSID\{B212D577-05B7-4963-911E-4A8588160DFA}
HKCR\CLSID\{1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5}
|
