high
Summary
Summary
Action- More Information
| How it spreads |
|
|---|---|
| Affected operating systems | Windows |
| Characteristics |
|
| Protection available since | 17 January 2008 15:38:51 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/KillJWS-A is a Trojan for the Windows platform. The Trojan targets the software commonly used for Windows accessibility by blind people. The Trojan is reportedly distributed as a crack program for the popular screen reader program JAWS version 9.
Troj/KillJWS-A is a Trojan for the Windows platform.When Troj/KillJWS-A is installed the following files are created:
<Windows>\config\svchost.exe
<Windows>\mci32.exe
<System>\securityService.dll
The following registry entries are created to run code exported by securityService.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\securityService
DllName
securityService.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\securityService
impersonate
0
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\securityService
Startup
startup
After 26 December 2007 Troj/KillJWS-A will terminate the following processes related to popular speech synthesis and speech recognition software:
jfw.exe
hal.exe
narrator.exe
wineyes
speech32
gwm32
kurzweil
|
