high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | September 2005 (3.97) |
| Protection available since | 12 July 2005 08:33:17 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/PPdoor-M is a backdoor Trojan for the Windows platform.
When Troj/PPdoor-M is installed the following files are created:
<System>\gofsklzk.dll
<System>\kasgfka.dll
The DLL files are harmless data files.
When run Troj/PPdoor-M opens the TCP port and allows a malicious user remote access to the system.
The following registry entry is created to run code exported by the Trojan library on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ ShellServiceObjectDelayLoad
Meeting Connection
(6A436F1A-92DA-4279-91D2-0F9955CE70DE)
The Trojan copies itself as <system32>\w3ssveds.exe. The following registry entries are created to run the Trojan on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Access WebControl
<path of Trojan>
The Trojan terminates the following processes:
*antispy
*avast
*avg
*buddybuddy
*firewall
*hauri
*kasper
*kav6
*kerio
*mcafee
*netshield
*norton
*panda
*sahagent
*spywarenuke
*sygate
*symant
*trend micro
180ax
32\angelex
80sainst
aawsepers
actalert
ad-aware.
ad-protect
addestr
adspider
adtools
ahadp.
angelex
ap9h4qmo
apvxdw
autoruns
avconsol
aveage
avguard.exe
avp32
avpcc
avpm
avpupd
avsynmgr
bargains
bcpc.exe
bigfix
blss.
bpc2_re_inst
bpcv2.exe
bpcv2_inst
bpt.exe
btv.exe
ca.exe
cashback
ccapp
cpd.exe
cxtpls.exe
dap\dap.
dc8.e
deskad
drweb
drwtsn32
dwwin
esyndic
exdl.
firewall
gah95on6
gcasdts
gcasserv
giantanti
hbsrv.
istsvc.
kav32.
kavi
kwatch
mcagent
mcshield
mcvsescn
mediaacc
mediapass
mksc.0
mpus
myagtt
navapp.
navapw
navw32
ncasepackage
netpia
nls.exe
nscheck
nsvsvc.exe
optimize.exe
ossproxy
outpost
pavsrv
pc-clean
pccgu
pccl
pccnt
persfw
pib.exe
popsub.
powerscan
procexp
pskill
radio.e
razin.exe
rootkit
saap.e
saie.exe
sais.e
salm
secure.e
security igu
sepinst.exe
shstat
sidefind
sistray
smc.exe
smcserv
spider
spybot
spyhunter
spymap.
spynet.
spyspotter
spysweeper
ssk.e
sskupd
startupmonitor
stopsignav
stopzilla
swdoctor
swn2.
sygate
syscheckbop32
Sysdll32
Sysexplr
sysgut
targetsaver
tbps
teatimer.
tmlist
tvm.exe
unsmss
uppicsvr
vcpdll.
virtualb
vptray
vsmon
vsstat
wareout
WeatherOnTray
webrebat
winadctl.exe
winupdtl.
wo.exe
wsup
wtools
wuauclt
wuauserv
zlclient
|
