high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 21 September 2006 21:48:44 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/WoWPWS-Y is a Trojan for the Windows platform.
Troj/WoWPWS-Y steals passwords for computer games, including World of Warcraft.
When first run Troj/WoWPWS-Y may copy itself to:
<Common Files>\iexplore.pif
<Program Files>\Internet Explorer\iexplore.com
<Windows folder>\1.com
<Windows folder>\Debug\DebugProgram.exe
<Windows folder>\ExERoute.exe
<Windows folder>\explorer.com
<Windows folder>\finder.com
<Windows folder>\smss.exe
<Windows system folder>\command.pif
<Windows system folder>\dxdiag.com
<Windows system folder>\finder.com
<Windows system folder>\msconfig.com
<Windows system folder>\regedit.com
<Windows system folder>\rundll32.com
The following registry entry may be created to run the Trojan on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TProgram
<Windows folder>\SMSS.EXE
The file iexplore.com usually is registered as a COM object, creating registry entries under:
HKCR\CLSID\<CLSID>
The Trojan includes functionality to change settings for Microsoft Internet Explorer by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\
The following registry entries may be set:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe 1
HKCR\.bfc\ShellNew
Command
<Windows system folder>\rundll32.com syncui.dll,Briefcase_Create %1!d! %2
HKCR\Drive\shell\find\command
(default)
<Windows folder>\explorer.com
HKCR\Unknown\shell\openas\command
(default)
<Windows system folder>\finder.com <Windows system folder>\shell32.dll,OpenAs_RunDLL %1
HKCR\cplfile\shell\cplopen\command
(default)
rundll32.com shell32.dll,Control_RunDLL %1,%*
HKCR\htmlfile\shell\opennew\command
(default)
"<Common Files>\iexplore.pif" %1
HKCR\htmlfile\shell\print\command
(default)
rundll32.com <Windows system folder>\mshtml.dll,PrintHTML "%1"
HKCR\inffile\shell\Install\command
(default)
<Windows system folder>\rundll32.com setupapi,InstallHinfSection DefaultInstall
132 %1
HKCR\scrfile\shell\install\command
(default)
finder.com desk.cpl,InstallScreenSaver %l
HKCR\scriptletfile\Shell\Generate Typelib\command
(default)
<Windows system folder>\finder.com" <Windows system folder>\scrobj.dll,GenerateTypeLib "%1
|
