high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | June 2005 (3.94) |
| Protection available since | 1 October 2004 10:02:31 (GMT) |
| Last updated | 13 May 2005 08:13:57 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please contact technical support.
More Information
Troj/Delf-FN is a Trojan for the Windows platform.
When executed the Trojan will copy itself to the files update.exe and kernel in the Windows system folder.
The Trojan will set the following registry keys:
HKLM\Software\Microsoft\Windows\Currentversion\Run
Windows Update
<Windows system>\Update.exe
HKLM\Software\Microsoft\Windows\Currentversion\RunServices
Kernel
<Windows system>\Update.exe
HKLM\Software\Classses\textfile\shell\open
command
<Windows system>\kernel "%1"
HKLM\Software\Microsoft\msd
scount
HKCU\Software\Microsoft\Windows\Currentversion\Policies\System
DisableRegistryTools = 1
Troj/Defl-FN may send emails containing confidential information stolen from the infected computer.
After the Trojan has been executed twenty times it will delete the Update.exe copy and start displaying an error message each time a text file is opened.
|
