high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | July 2008 (4.31) |
| Protection available since | 7 May 2008 10:24:11 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Kbot-A is a Trojan for the windows platform.
When first run Troj/Kbot-A copies itself to <System>\Spcvls.exe and creates the following files:
<System>\Spcvls.dll
<System>\Spcvls.ini
<System>\Spcvls.sys
The file Spcvls.dll is detected as Mal/Behav-010 and the file Spcvls.sys is detected as Troj/Kbot-A.
The file Spcvls.exe is registered as a new system service named "Spcvlsvs", with a display name of "Spcvl Srv" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\Spcvlsvs
The file Spcvls.sys is registered as a new system driver service named "SpcvlsvsDrv", with a display name of "SpcvlsvsDrv". Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\SpcvlsvsDrv
|
