high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | January 2006 (4.01) |
| Protection available since | 14 November 2005 21:49:52 (GMT) |
| Last updated | 24 November 2005 03:09:30 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dupa-B is a Trojan for the Windows platform.
Troj/Dupa-B includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/Dupa-B copies itself to <Windows folder>\dupadupam2.exe and creates the file <Windows folder>\waudio.exe.
The following registry entry is created to run Troj/Dupa-B on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WindowsUpdate
<pathname of the Trojan executable>
The file waudio.exe is registered as a new system driver service named "WindowsVideo", with a display name of "WindowsVideo" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\WindowsVideo\
|
