Troj/DwnLdr-FZZ

Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	March 2007 (4.15)
Protection available since	1 February 2007 10:12:04 (GMT)
Detected by	All Sophos products

Troj/DwnLdr-FZZ is a downloader Trojan for the Windows platform.

When run Troj/DwnLdr-FZZ creates the following files:
<Windows>\asver.ger
<Windows>\ftp.txt

The files asver.ger and ftp.txt are not malicious and can be safely deleted.

Troj/DwnLdr-FZZ includes functionality to:

- modify the HOSTS file
- download code via FTP

Troj/DwnLdr-FZZ also creates the following files:

<Windows>\initial.bat - detected as Troj/DwnLdr-FZZ
<Windows>\svc.bat - detected as Troj/DwnLdr-FZZ
<System>\win32.bat - detected as Troj/DwnLdr-FZZ

The following registry entry is set to run Troj/DwnLdr-FZZ on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
PC2X
<Windows>\initial.bat

Get reports about the latest virus and spyware threats delivered to your computer