high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | September 2005 (3.97) |
| Protection available since | 13 July 2005 13:12:17 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Bdoor-JD is a backdoor Trojan for the Windows platform.
When Troj/Bdoor-JD is installed the following files are created:
<Windows>\addins\AdmDll.dll
<Windows>\addins\dtreg.exe
<Windows>\addins\license.bat
<Windows>\addins\raddrv.dll
<Windows>\addins\serv.exe
<Windows>\addins\smrs.exe
The file license.bat is also detected as Troj/Bdoor-JD. The other files are legitimate applications, including a remote server application.
The file smrs.exe is registered as a new system driver service named "pnpext", with a display name of "Universal Serial Bus Control Protocol" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\pnpext\
The following registry entry is set:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
restrictanonymous
2
|
