Troj/Wock32-A

Category: Viruses and SpywareProtection available since:01 Apr 2003 00:00:00 (GMT)
Type: TrojanLast Updated:01 Apr 2003 00:00:00 (GMT)
Prevalence: No Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

Troj/Wock32-A is a backdoor Trojan.

Troj/Wock32-A copies itself to the file C:\Windows\java\apps\Wsock32.exe and sets the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\
User Shell Folders\Common Startup = C:\Windows\java\apps

HKLM\Software\Microsoft\Active Setup\Installed Components\
9EC0745F-CAD3-628A-48E9-02B9AFEC8E74\StubPath = C:\Windows\java\apps\Wsock32.exe

and subkeys below

HKLM\Software\EES\

with binary values.

Troj/Wock32-A also enables the Autodial feature of a dial-up connection by setting the registry entry

HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current\Software\
Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial = TRUE

The backdoor announces its presence to a URL providing information about the host IP, the listening port and the password required to connect to the backdoor. By default the Trojan listens on port 1063.

The same information is also sent to an ICQ userid using a specific web interface.

In order to be started automatically when the system is booted Troj/Wock32-A may also set one of the registry entries

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

or

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

to point to the Trojan binary.

Troj/Wock32-A attempts to detect and disable various monitoring, anti-virus and firewall related programs.