high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | November 2005 (3.99) |
| Protection available since | 12 September 2005 04:58:22 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Wayic-A is an information stealing Trojan.
Once installed, Troj/Wayic-A remains in the background, searching for web browser accesses to a massive multiplayer online role-playing gaming website and will begin storing information once the website has been accessed.
Troj/Wayic-A will then send the information to a remote website via email.
When first run Troj/Wayic-A copies itself to <Windows>\rundll32.exe and creates the file <System>\rxdll.dll.
The following registry entry is created to run rundll32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Regrx
<Windows>\rundll32.exe
Troj/Wayic-A also attempts to disable the following processes:
ZoneAlarm
EGHOST.EXE
MAILMON.EXE
KAVPFW.EXE
IPARMOR.EXE
RavMon.exe
|
