high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Included in our products from | October 2004 (3.86) |
| Protection available since | 17 August 2004 08:20:35 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
You will also need to edit the following registry entries. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_CLASSES_ROOT entries:
HKCR\CLSID\(037B3D58-D14A-4c41-BDFD-BD779B0B97BA)\
HKCR\HOL3_VXIEWER.FULL.1\
and delete them and all their sub-components.
Close the registry editor.
More Information
Troj/Dloader-BB is a downloader Trojan.
Troj/Dloader-BB is a DLL component that downloads files from the internet and runs them without the user's permission.
The Trojan runs as an extension to Internet Explorer.
When first run, Troj/Dloader-BB sets the following registry entries:
HKCR\CLSID\(037B3D58-D14A-4c41-BDFD-BD779B0B97BA)\
(Default) = vxiewer control
InprocServer32\(Default) = <SYSTEM>\vxiewer.ocx
InprocServer32\ThreadingModel = Apartment
Version\(Default) = 1,0,0,1
VersionIndependentProgID\(Default) = HOL3_VXIEWER.FULL
ProgID\(Default) = HOL3_VXIEWER.FULL
HKCR\HOL3_VXIEWER.FULL.1\
(Default) = vxiewer control
CLSID\(Default) = (037B3D58-D14A-4c41-BDFD-BD779B0B97BA)
Troj/Dloader-BB may download and run files to C:\holi<number>.exe where <number> is a number based on the time. The Trojan will then set registry entries under the following branch:
HKCU\Software\Holistyc\
|
