high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2005 (3.90) |
| Protection available since | 16 December 2004 21:40:50 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Domwis-E is an IRC backdoor Trojan that allows a remote user access to an infected computer.
When first run, the Trojan copies itself to the Windows folder as a hidden file named PASSCFG16.EXE.
In order to run automatically each time a user logs in, the Troj/Domwis-E sets the following registry entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows System Configuration
<Windows>\PASSCFG16.EXE
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Windows DLL Loader
<Windows>\PASSCFG16.EXE
Troj/Domwis-E can be used to:
delete, download, upload and execute remote files.
perform denial-of-service (DoS) attacks.
steal system information.
log key presses.
create screen and webcam captures.
scan other computers for open ports and vulnerabilities.
Troj/Domwis-E may create the file TEMP.BAT in the Windows folder. The file is used to add a user to the Administrators local group. This file can be safely deleted.
|
