high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 8 April 2005 13:01:47 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Orse-A is a Windows Trojan.
When run the Trojan copies itself to the Windows system folder as wisvc.exe, drops zlbw.dll (also in the Windows system folder) and either registers as a service process or creates the following registry keys so as to auto-start:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
updater
%SYSTEM%\wisvc.exe
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
updater
%SYSTEM%\wisvc.exe
Troj/Orse-A will attempt to download and execute components from a remote website which at the time of writing were unavailable.
The service created is "updater" and appears in the Service Control Manager as "Windows update Service".
zlbw.dll is a non-malicious ZLIB compression library.
|
