Troj/Shpiel-A

Please follow the instructions for removing Trojans.

Troj/Shpiel-A is a backdoor Trojan for the Windows platform.

When first run Troj/Shpiel-A copies itself to the Windows folder with a name chosen randomly from the following list :

'msnupdate.exe'
'winfog.exe'
'winsys.exe'
'lsass1.exe'
'lovcx.exe'
'winsress.exe'
'winlog.exe'
'winsock.exe'
'saveruser.exe'
'winbackup.exe'

The following registry entry is created to run Troj/Shpiel-A on startup :

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Hutley-Spieluhr
<Windows system folder>\<filename>

Troj/Shpiel-A creates an FTP server that listens by default on port 25 (normally reserved for SMTP) to enable uploading of files which can then be executed remotely using the server component of the Trojan.

Troj/Shpiel-A stores its configuration information such as FTP port number and logon credentials under the following registry entry :

HKLM\SOFTWARE\MsnSpieluhr\