high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 19 June 2006 13:17:24 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Xorpix-F is a proxy Trojan that allows a remote attacker to route network traffic through the infected computer. Troj/Xorpix-F is a proxy Trojan that allows a remote attacker to route network traffic through the infected computer.
When Troj/Xorpix-F is installed it creates the file <User>\Documents\Settings\arm32.dll. This file is also detected as Troj/Xorpix-F.
The following registry entries are created to run code exported by arm32.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg
DllName
<User>\Documents\Settings\arm32.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg
Startup
arm32reg
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\arm32reg
Impersonate
1
|
