high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2005 (3.90) |
| Protection available since | 24 December 2004 16:41:53 (GMT) |
| Last updated | 26 January 2005 10:10:12 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
svcroot
C:\Windows\System32\svcroot.exe
and delete it if it exists.
Close the registry editor.
More Information
Troj/Keylog-AC is a keylogging Trojan for the Windows platform.
In order to be run automatically at login time, the Trojan copies itself to the file svcroot.exe in the Windows system folder and creates the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
svcroot
C:\Windows\System32\svcroot.exe
Troj/Keylog-AC creates a file named svcroot.dll in the Windows system folder. This file is detected as Troj/Keylog-AC.
The Trojan may inject itself into the explorer process or register itself as a service process in order to prevent itself from being terminated.
Troj/Keylog-AC records keystrokes to the file gorsys32.dll in the Windows system folder. When this file becomes larger than 30kb, its contents are submitted to the author by email.
|
