Sophos

Troj/WLDrop-A

Aliases
  • W32/Agent.CIP
  • Spy-Agent.bv.dr
  • Win32/Wigon.W
  • Trojan.Win32.Agent.ady
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Protection available since 4 May 2007 03:42:20 (GMT)
Detected by All Sophos products
Download Free virus scan
Download the Threat Detection Test
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

More Information

Troj/WLDrop-A is a Trojan for the Windows platform.

When Troj/WLDrop-A is installed it creates one of the following files:

<System>\main.sys
<Current folder>\systems.dll

The file main.sys is detected as Troj/NTRootK-BP. The file systems.dll is detected as Mal/SpyAgent-A.

If the file main.sys is dropped, it is registered as a new system driver service named "EXAMPLE". Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\EXAMPLE

If the file systems.dll is dropped, the following registry entry is created to run it on system startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
rundll32 "<Current folder>\systems.dll" X4,explorer.exe

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer