Antivirus and Security Software from Sophos

Sophos blogs

Troj/Optix-03C

Category
Type
What to do
Prevalence low high

Summary

 
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

Please follow the instructions for removing Trojans.

Please read the instructions for removing Trojans.

You will also need to edit the following registry key, if it is present.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE key:

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\
User Shell Folders\ Common Startup = <Windows>\OleFiles\<Trojan name>

and remove the OleFiles reference.

Close the registry editor and reboot your computer.

More Information

Troj/Optix-03C is a backdoor Trojan which will run in the background as a server process, allowing a remote user (using a client program) to gain access and control over the computer.

When first run, it creates the sub-directory <Windows>\OleFiles\, moves itself there and creates the registry entry

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\
User Shell Folders\ Common Startup = <Windows>\OleFiles\<Trojan name>

This ensures that the server process is run automatically each time the computer is restarted.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer