Troj/Bravo-C

Aliases	Trojan-Proxy.Win32.Agent.gc Proxy-Agent.u trojan
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Drops more malware Installs itself in the registry
Included in our products from	February 2006 (4.02)
Protection available since	5 December 2005 13:57:47 (GMT)
Detected by	All Sophos products

Troj/Bravo-C is a Trojan for the Windows platform.

Troj/Bravo-C includes the functionality to communicate with a remove server via http.

When first run Troj/Bravo-C copies itself to:

\web.exe
<Windows>\assistse.exe
<Windows>\uninstall.exe

The following registry entries are created to run Troj/Bravo-C on startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Load
<Windows>\assistse.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Net
<Windows>\services.exe

The following registry entry is set:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
1

When run, Troj/Bravo-C creates and runs <Windows>\services.exe and this file is detected by Sophos as W32/Ritdoor-E.

When run, Troj/Bravo-C creates and runs <Windows>\h00kdll.dll and this file is detected by Sophos as Troj/LegMir-BS.

When run, Troj/Bravo-C may create and run the file C:\bbs.exe

Get reports about the latest virus and spyware threats delivered to your computer