high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2006 (4.02) |
| Protection available since | 22 November 2005 22:16:00 (GMT) |
| Last updated | 2 December 2005 14:04:23 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Chast-A is a backdoor and keylogging Trojan for the Windows platform.
When first run Troj/Chast-A copies itself to <Windows>\<random>.exe and creates the following files:
<Windows>\isnopt.dat
<Windows>\isnsys.dll
<Windows>\isnsys32zx.dll
<System>\isndata\data\<Username>\logapps.dat
<System>\isndata\data\<Username>\logwin.dat
The file isnsys32zx.dll is detected as Troj/Wilcol-A, and may be used to stealth Troj/Chast-A. The dat files are clean data files, and may safely be deleted. The file isnsys.dll is the keylogging component of the Trojan, and is also detected as Troj/Chast-A.
Troj/Chast-A can also log Instant Messaging conversations, as well as retrieve information about infected systems.
The following registry entry is created to run win16svc.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
System32Check
<Windows>\<random>.exe
|
