high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | June 2006 (4.06) |
| Protection available since | 5 May 2006 21:41:59 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Haxdoor-CA is a Trojan for the Windows platform.
Troj/Haxdoor-CA runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
Troj/Haxdoor-CA includes functionality to:
stealth its files, processes, registry entries and services
prevent itself being terminated
prevent itself being deleted
disable other software, including anti-virus, firewall and security related applications
Troj/Haxdoor-CA is a Trojan for the Windows platform.
Troj/Haxdoor-CA runs continuously in the background, providing a backdoor server which allows a remote intruder to gain access and control over the computer.
Troj/Haxdoor-CA includes functionality to:
stealth its files, processes, registry entries and services
prevent itself being terminated
prevent itself being deleted
disable other software, including anti-virus, firewall and security related applications
When Troj/Haxdoor-CA is installed the following files are created:
<Windows system folder>\klgcptini.dat
<Windows system folder>\qz.dll
<Windows system folder>\qz.sys
<Windows system folder>\stt82.ini
<Windows system folder>\vistaj.sys
<Windows system folder>\vistax.dll
The files qz.dll, qz.sys, vistaj.sys and vistax.dll are detected as Troj/Haxdor-Fam.
The following registry entries are created to run code exported by vistax.dll on startup:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vistax
DllName
vistax.dll
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vistax
Startup
CxaEqsData
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\vistax
Impersonate
1
The file vistaj.sys is registered as a new system driver service named "vistaj", with a display name of "SE 3.0 memory driver".
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\vistaj\
The file vistaj.sys is also registered as a new system driver service named "vistax", with a display name of "SE 3.2 memory driver" and a startup type of automatic, so that it is started automatically during system startup.
Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\vistax\
|
