high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 23 February 2005 14:02:43 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Riler-E is a backdoor Trojan.
Troj/Riler-E spies on network traffic on the infected computer. The Trojan will relay certain types of network traffic to a remote site.
Troj/Riler-E has a backdoor component that will connect to a remote site and await backdoor commands.
Troj/Riler-E may arrive by email as a CHM file with the following subject line:
China: Remembering the victims of police brutality in Gulja, Xinjiang on 5-6 Feb
When opened, the CHM file will drop and run a file named COO#KIE.EXE. The EXE file will drop a DLL with filename PATTONAT.DLL in the Windows system folder. All of these files are detected as Troj/Riler-E.
Troj/Riler-E will install the DLL as a Windows Sockets 2 transport provider and reorder the WSC Chain such that it gets called first. As a result, the Trojan may spy on the network traffic of applications.
Troj/Riler-E may create or change registry entries in the following locations:
HKLM\SYSTEM\CurrentControlSet\Services\WinSock2
HKLM\SYSTEM\CurrentControlSet\Services\WS2IFSL
|
