Sophos

Troj/Haxdoor-CO

Aliases
  • Trojan-Dropper.Win32.Small.apz
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Protection available since 12 July 2006 13:38:48 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Haxdoor-CO is a Trojan for the Windows platform.

When Troj/Haxdoor-CO is installed the following files are created:

<Temp>\10320054.gif
<System>\dvb03a.dll
<System>\dvb03a.sys
<System>\dvb06a.sys
<System>\kgctini.dat
<System>\klo5.sys
<System>\lps.dat
<System>\qo.dll
<System>\qo.sys

The files dvb03a.dll, dvb03a.sys, dvb06a.sys, qo.dll and qo.sys are detected as Troj/Haxdor-Fam. The other files are clean configuration and data files.

The following registry entries are created to run code exported by dvb03a.dll on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
DllName
dvb03a.dll

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
Startup
DVBz637890

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dvb03a
Impersonate
1

The file dvb06a.sys is registered as a new system driver service named "dvb06a", with a display name of "WDVB 05". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\dvb06a\

The following registry entries are set, affecting internet security:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS
Explorer.EXE
<Windows>\Explorer.EXE:*:Enabled:explorer

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer