high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | May 2008 (4.29) |
| Protection available since | 31 March 2008 20:22:32 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Ranck-FT is a HTTP proxy server Trojan.
Troj/Ranck-FT runs continuously in the background listening on a randomly generated port and allows HTTP traffic to be relayed through the computer.
The Troj/Ranck-FT proxy server may be used to forward spam.
When Troj/Ranck-FT becomes active it sends a notification message to a remote location, specifying the IP address of the current computer and the randomly generated port number which will typically be within the range 10000 - 50000.
Troj/Ranck-FT includes functionality to provide a proxy server.
When first run Troj/Ranck-FT copies itself to <System>\venusu-xxx-com.exe and creates the file <System>\venusu-xxx-com.dll.
The following registry entry is created to run venusu-xxx-com.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
<variable>
<System>\venusu-xxx-com.exe
|
