Sophos

Troj/Bifrose-DE

Aliases
  • suspicion:
  • Mail
  • Bomb
  • New
  • Malware.w
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Drops more malware
  • Installs itself in the registry
Included in our products from March 2006 (4.03)
Protection available since 13 January 2006 14:16:33 (GMT)
Detected by All Sophos products

Action

More Information

Troj/Bifrose-DE is a Trojan for the Windows platform.

When first run Troj/Bifrose-DE copies itself to &l;tSystem>\Explorer.exe and creates the following files:

<Temp>\pct.dll
<System>\12344.dat

The file pct.dll is detected as Troj/Hackvan-E.

The following registry entries are created to run Troj/Bifrose-DE on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
456655
<System>\Explorer.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
456655
<System>\Explorer.exe

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\(9B71D88C-C598-4935-C5D1-43AA4DB90836)
stubpath
<System>\Explorer.exe s

Registry entries are created under:

HKCU\Software\Wget\

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer