Antivirus and Security Software from Sophos

Sophos blogs

Troj/Pushdo-AI

Aliases
  • Trojan-Dropper.Win32.Agent.ajkv
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Protection available since 24 March 2009 17:09:53 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/Pushdo-AI is a password stealing Trojan for the Windows platform.

When first run Troj/Pushdo-AI installs the following file which is detected separately as Troj/Rootkit-FJ:

<System>\drivers\nicsk32.sys

The file nicsk32.sys is registered as a new service named "nicsk32". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\nicsk32

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer