high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | July 2006 (4.07) |
| Protection available since | 14 May 2006 19:57:46 (GMT) |
| Last updated | 16 May 2006 12:31:42 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/GWGhost-BA is a backdoor Trojan with password stealing capabilities. It allows a remote intruder to gain unauthorized access and control over the computer.
Troj/GWGhost-BA is capable of logging keystrokes and sending them to a remote location.
When run, the Trojan creates a copy of itself to the Windows System folder as msisexec.exe and creates the file <Windows system folder>\inetapi32.dll (also detected as Troj/GWGhost-BA).
The Trojan creates the following registry entry in order to run each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SCANREGW
"msisexec.exe"
|
