 |
W32/Haxdoor.IS Trojan
| Name |
W32/Haxdoor.IS Trojan |
| Aliases |
BKDR_HAXDOOR.IS, Haxdoor.KI, Backdoor.Haxdoor.P |
| Discovered on |
August 17, 2006 |
 Virus Information - W32/Haxdoor.IS Trojan:
W32/Haxdoor.IS is a trojan. The trojan will infect Windows systems and spreads through email.
The trojan will arrive as an attachment along with a spammed email.
Upon execution, the trojan drops the following files in Windows System folder.
qo.dll
qo.sys
xdpptp.sys
xopptp.dll
xopptp.sys
yvprgb.dll
ycsrgb.sys
The trojan modifies registry at the following location to load itself during each startup.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xopptp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\xdpptp.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\xdpptp.sys
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xdpptp
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\xopptp
It injects xopptp.dll in explorer.exe and executes a remote thread.
|
