high
Summary
Summary
Action- More Information
| Protection available since | 7 July 2004 08:11:12 (GMT) |
|---|---|
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
You should also change your Internet Explorer settings using Tools|Internet|options|General to remove any modifications made by the Trojan.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry for each user who ran the virus. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export Range' panel, click 'All', then save your registry as Backup.
Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:
HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\wininet32 = %WINDOWS%\wininet32.exe
and delete it if it exists.
Close the registry editor.
More Information
Troj/Raznew-A is a proxy backdoor Trojan which runs continuously in the background providing a proxy server on port 8080.
Data can be routed to other computers via the proxy, in order to bypass access restrictions and to hide the IP address of the source computer.
The proxy may be used to forward SPAM email.
The Trojan assumes that it has been installed to the Windows folder as wininet32.exe and creates the following registry entry to run itself automatically on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
wininet32 = %WINDOWS%\wininet32.exe
The Trojan changes proxy server internet options for the local computer which will typically create the following registry entries:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ProxyServer = <IP address of local computer>:8080
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ProxyOverride = "local"
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ProxyEnable = 1
HKLM\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Microsoft\
windows\CurrentVersion\Internet Settings\ProxyEnable = 1
HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\0001\
Software\Microsoft\windows\CurrentVersion\Internet Settings\
ProxyEnable = 1
Troj/Raznew-A may be launched by Troj/ESearch-A.
|
