high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2005 (3.90) |
| Protection available since | 18 December 2004 16:49:41 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dloader-ET is a downloader Trojan for the Windows platform. The Trojan
will create a folder called golumm under the Windows system folder and copy
itself there as services.exe. Troj/Dloader-ET will then download and execute
files from http://www.newiframe.biz. Some of the files downloaded are
recognized malware while others are configuration files telling the Trojan
other files to download and execute.
Every 60 seconds Troj/Dloader-ET will contact http://www.newiframe.biz to
download a file listing urls to display and executables to download and
execute.
Troj/Dloader-ET will create the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
golumm
<Windows system folder>\golumm\services.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
sysinit
<Windows system folder>\golumm\services.exe
|
