high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | May 2006 (4.05) |
| Protection available since | 4 April 2006 22:19:57 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/ConHook-H is a Trojan for the Windows platform.
The Trojan attempts to download and run further malicious code without the user's knowledge.
When Troj/ConHook-H is installed the following files are created:
<Windows system folder>\awvvv.dll
The following registry entries are created to run code exported by awvvv.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awvvv
DllName
awvvv.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awvvv
Impersonate
0
The file awvvv.dll is registered as a COM object and ShellExecute hook, creating registry entries under:
HKCR\CLSID\{8E13DDE1-E013-47ec-9C4C-27C2F78BDD26}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
{8E13DDE1-E013-47ec-9C4C-27C2F78BDD26}
|
