high
Summary
Summary
Action- More Information
| Included in our products from | January 2004 (3.77) |
|---|---|
| Protection available since | 26 November 2003 16:35:33 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Online Service= C:\<Windows>\SYSTEM.EXE
and delete it if it exists.
Close the registry editor.
More Information
Troj/Tofger-B is a multi-component Trojan which consists of a main dropper, a backdoor Trojan component and keylogging component.
The main dropper is called MSTASKS.EXE which may be downloaded and executed on the victim's computer if certain infected HTML or PHP pages are accessed (these scripts are detected as VBS/Tofger-B).
MSTASKS.EXE drops the files:
C:\<Windows>\MSTO32.DLL
C:\<Windows>\SYSTEM.EXE
C:\<Windows>\SYSINI.INI
C:\<Windows system>\SVCHOSTC.EXE
C:\<Windows system>\SVCHOSTS.EXE
and executes C:\<Windows>\SYSTEM.EXE.
MSTASKS.EXE also adds the following entry to the registry to run SYSTEM.EXE on system restart:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Online Service
= C:\<Windows>\SYSTEM.EXE
SYSTEM.EXE runs in the background as a service process, opens port 10002 and listens for backdoor commands from a remote intruder.
MSTO32.DLL is the keylogging component of the Trojan and is invoked by SYSTEM.EXE.
SYSTEM.EXE also executes the files SVCHOSTC.EXE and SVCHOSTS.EXE which are legitmate freeware proxy HTTP and socket servers.
SYSTEM.EXE may also open a window which masquerades as the logon page for an internet bank account.
Text entered into the fake logon page and any keylogged information may be emailed to an external email address via SMTP.
The Trojan may also communicate with a remote website.
Troj/Tofger-B may attempt to download and execute EXE files from the internet.
|
