high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | July 2005 (3.95) |
| Protection available since | 26 May 2005 21:19:13 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dloader-NZ is a downloading Trojan for the Windows platform.
Troj/Dloader-NZ creates the following registry entry to run itself automatically on log-on:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CacheLoader
<path of filename>
Troj/Dloader-NZ attempts to download an executable from a preconfigured URL to a randomly named file with ".tmp" extension. It creates "Cache" subfolder of the Windows folder. If this download is interrupted Troj/Dloader-NZ will resume at the next logon.
Once the file has finished being downloaded, it is moved to the file "Security iGuard.exe" in the Program Files folder and executed.
Troj/Dloader-NZ creates the following registry entries for its own use:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
CachedFileName
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer
CachedActualFileSize
|
