high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | April 2005 (3.92) |
| Protection available since | 4 March 2005 13:55:31 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dloader-IX is a downloading Trojan for the Windows platform.
Troj/Dloader-IX creates the following registry entry to run itself automatically on log-on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
CacheLoader
<filename>
(where <filename> is the full path to the Trojan executable)
Troj/Dloader-IX attempts to download an executable from a preconfigured URL to a randomly named file in the "Cache" subfolder of the Windows folder. If this download is interrupted Troj/Dloader-IX will resume at the next logon.
Once the file has finished being downloaded, it is moved to the file "Security iGuard.exe" in the Program Files folder and executed.
Troj/Dloader-IX creates the following registry entries for its own use:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
CachedFileName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
CachedActualFileSize
|
