high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | August 2005 (3.96) |
| Protection available since | 17 June 2005 09:10:32 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Services Process
<Windows>\System32\config\smss.exe
and delete it if it exists.
Close the registry editor.
More Information
Troj/Small-EK is a backdoor Trojan which may attempt to steal files and other information from the infected computer.
When run the Trojan drops smss.exe into the Windows system32\config folder and ieaddon.dll into the Windows system32 folder.
Troj/Small-EK also creates the following registry entry so as to auto-start on computer restart:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Services Process
<Windows>\System32\config\smss.exe
The Trojan will also create non-malicious files catuid.dll and cryptiso.dll in the Windows system32 folder which can be safely deleted.
|
