Troj/OptixP-M

Please follow the instructions for removing Trojans.

Troj/OptixP-M is a backdoor Trojan which allows a remote intruder to gain access and control over the computer.

Troj/OptixP-M includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/OptixP-M copies itself to:

<System>\msnsyst32win.exe
<System>\qwinsyst32.exe

A variant of the Trojan copies itself to the following locations:

<System>\g78zghwin.exe
<System>\m87r8syst32.exe

The Trojan may drop a file detected as Troj/Optix-PRO.

The following registry entries are created to run Troj/OptixP-M on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<randome>
<pathname of the Trojan executable>

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
<random>
<pathname of the Trojan executable>

The following registry entry is set or modified, so that the Trojan is run when files with extensions of EXE are opened/launched:

HKCR\exefile\shell\open\command
(default)
<System>\<Trojan filename> PASS "%1" %*

The following registry entries are set, affecting internet security:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial