high
Summary
Summary
Action- More Information
| Included in our products from | August 2004 (3.84) |
|---|---|
| Protection available since | 2 July 2004 14:52:27 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Padodor-K is a Trojan which installs an Internet Explorer plugin.
In order to run on startup the Trojan creates the following files in the Windows system folder:
a randomly named exe (a copy of the Trojan)
a randomly named Dll (the IE plugin)
Troj/Padodor-K creates the following registry entries in order to register the plugin:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\
BrowseNewProcess\BrowseNewProcess = "yes"
HKCR\CLSID\(79FEACFF-FFCE-815E-A900-316290B5B738)\
HKCR\CLSID\(79FEACFF-FFCE-815E-A900-316290B5B738)\InProcServer32\
@ = "C:\\WINDOWS\\System32\\
HKCR\CLSID\(79FEACFF-FFCE-815E-A900-316290B5B738)\InProcServer32\
ThreadingModel = "Apartment"
HKCR\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
Web Event Logger = "(79FEACFF-FFCE-815E-A900-316290B5B738)"
The Trojan also changes the security settings for all Internet Zones, creates an HTML file in the current user's Temporary Internet Files folder and opens this file with Internet Explorer in an attempt to steal sensitive information.
|
