Troj/Haxdoor-AX

Aliases	Trojan-Spy.Win32.Goldun.hw BackDoor-BAC.gen.dr
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Drops more malware Installs itself in the registry
Protection available since	27 February 2006 22:42:13 (GMT)
Last updated	7 March 2006 15:29:20 (GMT)
Detected by	All Sophos products

Sophos beta program
Register now for our latest beta tests

Troj/Haxdoor-AX is a backdoor Trojan for the Windows platform.

Troj/Haxdoor-AX drops components detected as Troj/Haxdor-Gen and Troj/Haxdor-Fam. Troj/Haxdoor-AX is a backdoor Trojan for the Windows platform.

When Troj/Haxdoor-AX is installed the following files are created:

<Windows system folder>\directprt.sys
<Windows system folder>\directpt.dll

The file directprt.sys is detected as Troj/Haxdor-Gen and the file directpt.dll is detected as Troj/Haxdor-Fam.

The following registry entries are created to run code exported by directpt.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directpt
DllName
directpt.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directpt
Startup
directpt

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\directpt
Impersonate
1

Get reports about the latest virus and spyware threats delivered to your computer