Sophos

Troj/Haxdoor-BK

Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Protection available since 30 March 2006 14:35:57 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Haxdoor-BK is a backdoor Trojan for the Windows platform.

When Troj/Haxdoor-BK is installed the following files are created:
<System>\klgcptini.dat
<System>\mst7.bin
<System>\pptp32.dll
<System>\pptp64.sys
<System>\qz.dll
<System>\qz.sys

The files pptp32.dll and qz.dll are detected as Troj/Haxdor-Fam and the files pptp64.sys and qz.sys are detected as Troj/Haxdor-Gen.

The following registry entries are created to run code exported by pptp32.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pptp32
DllName
pptp32.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pptp32
Startup
SeImageDBG

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pptp32
Impersonate
1

The file pptp64.sys is registered as a new system driver service named "pptp32", with a display name of "MMX2 virtualization service" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\pptp32\

The file pptp64.sys is registered as a new system driver service named "pptp64", with a display name of "MMX virtualization service". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\pptp64\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer