Troj/Tibs-PM

Aliases	Trojan-Downloader.Win32.Tibs.jp Win32/TrojanDownloader.Small.AWA
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Protection available since	3 December 2006 04:58:53 (GMT)
Detected by	All Sophos products

Free virus scan
Download the Threat Detection Test

Troj/Tibs-PM is a Trojan for the Windows platform.

Troj/Tibs-PM includes functionality to download and run further executable code.

When first run Troj/Tibs-PM copies itself to <System>\kernels88.exe and creates the file <System>\dlh9jkd1q8.exe.

The following registry entry is created to run kernels88.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System
<System>\kernels88.exe

The following registry entry is set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
1

Get reports about the latest virus and spyware threats delivered to your computer