high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | July 2006 (4.07) |
| Protection available since | 7 September 2005 12:57:48 (GMT) |
| Last updated | 29 May 2006 22:40:20 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Paymite-B is a Start Page Trojan. Troj/Paymite-B is a Start Page Trojan.
In order to run automatically, the Trojan will set the following registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
PayTime
<System>\paytime.exe
Troj/Paymite-B changes settings for Microsoft Internet Explorer, including the Start Page, by modifying values under:
HKCU\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
HKCU\Software\Microsoft\Internet Explorer\Main\
HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page
Troj/Paymite-B may attempt to run the following files, if they exist:
<Windows>\tool2.exe
<System>\tibs.exe
<System>\paydial.exe
<System>\newdial.exe
|
