high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | December 2005 (4.00) |
| Protection available since | 18 October 2005 13:21:55 (GMT) |
| Last updated | 20 October 2005 03:41:13 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/GWGhost-S is a password stealing Trojan for the Windows platform which also attempts to download further code from a remote website.
Troj/GWGhost-S includes functionality to access the internet and communicate with a remote server via HTTP.
When first run Troj/GWGhost-S copies itself to <System>\foxrxjh.exe and creates the file <System>\locarxjh.sls. It also attempts to download a file from a remote website and install it as <System>\cac1s.exe. locarxjh.sls is also detected as Troj/GWGhost-S, and is the password stealing component of the Trojan.
The following registry entry is created to run foxrxjh.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
foxrxjh
<System>\foxrxjh.exe
|
