high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 9 September 2004 08:09:56 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Small-UW is a backdoor Trojan which allows a remote intruder to access and control the computer via IRC channels.
When first run Troj/Small-UW moves itself to the Windows system folder as svcnxp32.exe and creates the following new registry entry, so that svcnxp32.exe is run automatically on startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WindowsXPserv = svcnxp32.exe
Whilst the Trojan is active it refreshes this registry entry every 1 second in an attempt to prevent its deletion.
Troj/Small-UW tries to connect to a remote IRC server on port 6667 using a random nickname and join a specific channel.
The Trojan then listens on the channel for instructions specified by a remote intruder. A remote intruder can instruct the Trojan to carry out various actions such as download and run new executable files.
|
