Troj/Theef-C

Aliases	Backdoor.Win32.Delf.dy BackDoor-QW BKDR_QW.A
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Protection available since	2 February 2006 13:52:38 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Troj/Theef-C is a backdoor Trojan for the Windows platform.

Troj/Theef-C includes functionality to access the internet and communicate with a remote server via HTTP.

When first run Troj/Theef-C copies itself to <Windows>\vbrun32_.exe and creates the following files:

<Windows>\_wincd32.drv
<Windows>\winhnd64.drv
<Windows>\wmmov32.drv

These files _wincd32.drv, winhnd64.drv, and wmmov32.drv are clean and can simply be deleted.

The following registry entry is created to run vbrun32_.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
VBRuntime
<Windows>\vbrun32_.exe

Get reports about the latest virus and spyware threats delivered to your computer