high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | June 2008 (4.30) |
| Protection available since | 2 May 2008 18:06:06 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/RKDrop-A is a Trojan for the Windows platform.
When Troj/RKDrop-A is installed the following files are created:
<Temp>\_it.bat
<System>\drivers\qandr.sys
The file qandr.sys is detected as Mal/Rootkit-C. The file _it.bat can safetly be deleted.
The file qandr.sys is registered as a new system driver service named "qandr", with a display name of "qandr" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\qandr
At the time of writing, Troj/RKDrop-A is being sent out in spam emails pretending to be photographs. A typical message is:
Subject: Hi, remember me?..
Hi, remember me?..
new fotos(archived) you asked ;))
http://<domain removed>/My_foto.exe
kiss,
Angella O.
|
