high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | June 2006 (4.06) |
| Protection available since | 7 April 2006 13:51:27 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/HacDef-EQ includes a root kit functionality to hide malicious processes and give them system process privileges.
When first run Troj/HacDef-EQ copies itself to <System>\msdndr.pif and creates the file <System>\msdndr.dat.
The file msdndr.pif is registered as a new system driver service named "msdndr", with a display name of "MSDN Driver" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\msdndr\
The following registry entry is set, affecting internet security:
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
MigrateProxy
1
|
