[cut-n-paste from sophos.com]

Name   Troj/StraDr-Fam

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware

Aliases  
    * Email-Worm.Win32.Warezov.fb
    * Win32/Stration
    * PAK_Generic.001

Prevalence (1-5) 3

Description
Troj/StraDr-Fam detects a family of Trojan droppers.

Advanced
Troj/StraDr-Fam detects a family of Trojan droppers.

When run, the Trojan will create a randomly named executable file in 
the Windows system folder and run it. This file is detected as 
W32/Strati-Gen.





Name   W32/Stration-CH

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Drops more malware
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Warezov.fb
    * Win32/Stration

Prevalence (1-5) 3

Description
W32/Stration-CH is a network worm for the Windows platform.

W32/Stration-CH includes functionality to download, install and run 
new software.

Advanced
W32/Stration-CH is a network worm for the Windows platform.

W32/Stration-CH includes functionality to download, install and run 
new software.

When W32/Stration-CH is installed it creates the file 
\.exe (where  is a series of 10 
randomly-selected letters). This file is detected as W32/Strati-Gen.

When first run, W32/Stration-CH displays the following message box:

Title: Error
Message: Unknown error





Name   Troj/Bancos-AXX

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Uses its own emailing engine
    * Leaves non-infected files on computer

Aliases  
    * Trojan-Spy.Win32.Bancos.zv

Prevalence (1-5) 2

Description
Troj/Bancos-AXX is a password-stealing Trojan for the Windows platform.

When first run Troj/Bancos-AXX displays a fake user interface in 
order to pretend to be MSN Messenger.

Information stolen by the Trojan may be sent to a remote user by email.

Advanced
Troj/Bancos-AXX is a password-stealing Trojan for the Windows platform.

When first run Troj/Bancos-AXX displays a fake user interface in 
order to pretend to be MSN Messenger.

Information stolen by the Trojan may be sent to a remote user by email.

Stolen information may be stored in the file \tempxyz.dll.





Name   Troj/Lineag-AFB

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Lineag-AFB is a password-stealing Trojan for the Windows platform.

Advanced
Troj/Lineag-AFB is a password-stealing Trojan for the Windows platform.

When Troj/Lineag-AFB is installed the following files are created:

\uxx.dll
\Windows Media Player\svchost.exe
\pdll.dll

The following registry entry is changed to run Troj/Lineag-AFB on 
startup:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit
\userinit.exe,\Windows Media Player\svchost.exe,

(the default value for this registry entry is 
"\System32\userinit.exe,").





Name   W32/Looked-BC

Type  
    * Virus

How it spreads  
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Steals information
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
W32/Looked-BC is a Windows executable virus and network worm.

Advanced
W32/Looked-BC is a Windows executable virus and network worm.

When first run the virus copies itself to \rundl132.exe and 
creates a file \RichDll.dll, also detected as W32/Looked-BC. 
This file attempts to download further malicious code.

The virus infects EXE files found on the infected computer. The virus 
also attempts to copy itself to remote network shares.

Many files with the name "_desktop.ini" are created, in various 
folders on the infected computer. These files are harmless text files.

The following registry entry is created in order to run the virus on 
startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
\rundl132.exe





Name   Troj/Murlo-Q

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry
    * Leaves non-infected files on computer

Aliases  
    * Trojan-Downloader.Win32.Murlo.ek

Prevalence (1-5) 2

Description
Troj/Murlo-Q is a Trojan for the Windows platform.

Troj/Murlo-Q includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/Murlo-Q is a Trojan for the Windows platform.

Troj/Murlo-Q includes functionality to access the internet and 
communicate with a remote server via HTTP.

When Troj/Murlo-Q is installed it creates the following files:

\.exe (more than one)

\sysvx.exe

\Local Settings\Temp\tmp.tmp (more than one)

\Local Settings\Temp\tmp.bat (more than one)

The above mentioned files are innocuous and may simply be deleted. 
The BAT files are used to remove the Trojan executable after execution.

The following registry entry is set:

HKLM\SOFTWARE\Microsoft\Internet Explorer
UID






Name   W32/Stratio-CG

Type  
    * Worm

How it spreads  
    * Email attachments

Affected operating systems  
    * Windows

Side effects  
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Forges the sender's email address
    * Uses its own emailing engine

Prevalence (1-5) 2

Description
W32/Stratio-CG is a worm for the Windows platform.

When run W32/Stratio-CG creates a file with a random filename in the 
Windows System folder. This file is detected by Sophos as 
W32/Strati-Gen.





Name   Troj/LowZone-DS

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Trojan-Clicker.Win32.Agent.ip

Prevalence (1-5) 2

Description
Troj/LowZone-DS is a Trojan for the Windows platform.

Troj/LowZone-DS includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/LowZone-DS is a Trojan for the Windows platform.

Troj/LowZone-DS includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run Troj/LowZone-DS copies itself to the Windows system 
folder and creates the following files:

\Internet Explorer.lnk
\Start Menu\Internet Explorer.lnk

The following registry entry is created to run Troj/LowZone-DS on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

\winsvc\svc\

The file  is registered as a COM object, 
creating registry entries under:

HKCR\CLSID\(16C7013F-912E-42ac-AA8E-A10A180DFF51)

The following registry entries are set, affecting internet security:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\Domains\gooogle.bz

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\Domains\gooogle.bz\www

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\
ZoneMap\Domains\gooogle.bz\www
*
2

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings\Zones\2
1004
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings\Zones\2
1201
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings\Zones\2
MinLevel
0

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet 
Settings\Zones\2
RecommendedLevel
0

Registry entries are set as follows:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\
\NameSpace\(16C7013F-912E-42ac-AA8E-A10A180DFF51)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\
NameSpace\(16C7013F-912E-42ac-AA8E-A10A180DFF51)

HKCU\Software\Microsoft\Internet Explorer\Main
Start Page
http://www.gooogle.bz





Name   Troj/Bombka-P

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Installs a browser helper object

Prevalence (1-5) 2

Description
Troj/Bombka-P is a Trojan for the Windows platform.

When run, the Trojan sets registry entries under:

HKCR\Comcap16.ComCap\
HKCR\Comcap16.ComCap.1\





Name   W32/Stration-CI

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Drops more malware
    * Downloads code from the internet

Aliases  
    * Email-Worm.Win32.Warezov.gz
    * Email-Worm.Win32.Warezov.dq
    * Win32/Stration.RJ
    * WORM_STRAT.GS

Prevalence (1-5) 2

Description
W32/Stration-CI is a network worm for the Windows platform.





Name   W32/Kidala-I

Type  
    * Worm

How it spreads  
    * Network shares
    * Peer-to-peer

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Prevalence (1-5) 2

Description
W32/Kidala-I is a mass-mailing worm and IRC backdoor Trojan for the 
Windows platform.

Advanced
W32/Kidala-I is a mass-mailing worm and IRC backdoor Trojan for the 
Windows platform.

W32/Kidala-I spreads:

- via file sharing on P2P networks
- to other network computers infected with: Troj/Kuang, Troj/Sub7, 
W32/Sasser, Troj/NetDevil, W32/MyDoom, W32/Bagle and Troj/Optix
- to other network computers by exploiting common buffer overflow 
vulnerabilities, including: LSASS (MS04-011), RPC-DCOM (MS04-012), 
WKS (MS03-049) (CAN-2003-0812), WebDav (MS03-007), IIS5SSL (ms04-011) 
(CAN-2003-0719), Veritas (CAN-2004-1172), Dameware (CAN-2003-1030), 
MSSQL (MS02-039) (CAN-2002-0649) and PNP (MS05-039)

When first run W32/Kidala-I copies itself to:

\My Downloads\YahooMessenger_Loader.scr
\KaZaA\My Shared Folder\icq2006-final.bat
\eDonkey2000\Incoming\Angilina_Jolie_Sucks_a_Dick.scr
\sysmon.exe

The following registry entry is created to run sysmon.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Win32
\sysmon.exe





Name   Troj/Remadm-P

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Enables remote access

Prevalence (1-5) 2

Description
Troj/Remadm-P is a backdoor Trojan for the Windows platform.

Troj/Remadm-P enables remote users to virtually control an infected 
system.





Name   Troj/Dloadr-ARB

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Downloader.Win32.QQHelper.qr

Prevalence (1-5) 2

Description
Troj/Dloadr-ARB is a Trojan for the Windows platform.

Troj/Dloadr-ARB contains functionality to download and run further 
executable code.





Name   W32/VB-CUZ

Type  
    * Spyware Worm

Affected operating systems  
    * Windows

Side effects  
    * Steals information
    * Uses its own emailing engine
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.VB.cb
    * Generic

Prevalence (1-5) 2

Description
W32/VB-CUZ is a password stealing worm for the Windows platform.

W32/VB-CUZ includes functionality to send notification messages to 
remote
locations.

Advanced
W32/VB-CUZ is a password stealing worm for the Windows platform.

W32/VB-CUZ includes functionality to send notification messages to 
remote
locations.

When first run W32/VB-CUZ copies itself to:

\svchost.exe
\BttnServ.exe

The following registry entries are created to run W32/VB-CUZ on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
(Default)
\svchost.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
CPQEASYBTTN
\BttnServ.exe





Name   Troj/Dloadr-ARE

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Prevalence (1-5) 2

Description
Troj/Dloadr-ARE is a downloader Trojan for the Windows platform.

Troj/Dloadr-ARE includes functionality to download and install 
further software.

When run the Trojan creates a randomly named DLL file in the Windows 
system folder. The DLL is also detected as Troj/Dloadr-ARE.





Name   W32/Dref-R

Type  
    * Virus

How it spreads  
    * Email attachments
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Sends itself to email addresses found on the infected computer
    * Drops more malware
    * Forges the sender's email address
    * Uses its own emailing engine
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry

Aliases  
    * Email-Worm.Win32.Glowa.g

Prevalence (1-5) 2

Description
W32/Dref-R is a mass-mailing worm and parasitic virus with IRC 
backdoor functionality for the Windows platform.

Advanced
W32/Dref-R is a mass-mailing worm and parasitic virus with IRC 
backdoor functionality for the Windows platform.

When first run W32/Dref-R copies itself to \wservice.exe and 
creates the following following file.

\doC0R24.exe

The file doC0R24.exe is detected as Troj/Dloadr-APW.

W32/Dref-R will attempt to infect SCR, HTM, HTA, EXE and RAR files 
then email itself as an attachment to email addresses harvested from 
the infected computer.

Files infected with the virus are detected as W32/Dref-L.

W32/Dref-R may arrive in an email message with the following 
characteristics:

Subject line: chosen from

White house news!
READ AND RESEND ASAP!
NEWS!
ATTN TO EVERYBODY!
Incredible news!
ATTN
URGENT NEWS!
URG

Message text: chosen from

3rd Glogal War Just Started!!! Read more in file!
Nuclear War in Russia! Read news in file!
President Bush DEAD! Read attached file!
Putin and Bush starts NUCLEAR WAR! Check the file!
Nuclear WAR in USA! Read attached file!
GLOBAL NUCLEAR WAR JUST STARTED! News in file.
President Putin dead! Read more in attached file!

Attached file:chosen from

truth.exe
last.exe
lasest news.exe
never.exe
war.exe
about me.exe
a.exe
read me .exe
open.exe

The files attached in the emails are detected as Troj/Dloadr-APW.

The following registry entries are created to run wservice.exe on 
startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
UpdateService
\wservice.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
UpdateService
\wservice.exe

W32/Dref-R sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess
Start
4

Note: disabling autostart for the SharedAccess service deactivates 
the Microsoft Internet Connection Firewall (ICF).





Name   Troj/LdPinc-AZE

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Steals information

Aliases  
    * Trojan-PSW.Win32.LdPinch.aze
    * Win32/PSW.LdPinch.NCC

Prevalence (1-5) 2

Description
Troj/LdPinc-AZE is a password-stealing Trojan for the Windows platform.

Advanced
Troj/LdPinc-AZE is a password-stealing Trojan for the Windows platform.

When Troj/LdPinc-AZE is installed the following files are created:

\Pinch.exe
\csrss.exe
\hook.txt

The files csrss.exe and Pinch.exe are also detected as Troj/LdPinc-AZE.

The following registry entry is created to run Troj/LdPinc-AZE on 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
system
\csrss.exe





Name   Troj/BagleDl-BW

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/BagleDl-BW is a downloader Trojan for the Windows platform.

The Trojan includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
Troj/BagleDl-BW is a downloader Trojan for the Windows platform.

The Trojan includes functionality to access the internet and 
communicate with a remote server via HTTP.

When run the Trojan copies itself to \wintems.exe.

The following registry entry is created to run wintems.exe on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
german.exe
\wintems.exe





Name   Troj/Banloa-ASE

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet

Aliases  
    * Trojan-Spy.Win32.Banker.bdr

Prevalence (1-5) 2

Description
Troj/Banloa-ASE is a downloader Trojan for the Windows platform.

Advanced
Troj/Banloa-ASE is a downloader Trojan for the Windows platform.

When run Troj/Banloa-ASE attempts to copy itself to 
\explore.exe and sets the following registry entries to run 
itself on startup:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
IntSys1


HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
IntSys1






Name   W32/Tilebot-IC

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Allows others to access the computer
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.SdBot.aad
    * WORM_SDBOT.EAI

Prevalence (1-5) 2

Description
W32/Tilebot-IC is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Tilebot-IC spreads to other network computers:

- by exploiting common buffer overflow vulnerabilities, including: 
LSASS
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), WKS (MS03-049) and 
ASN.1
(MS04-007).
- through network shares.

W32/Tilebot-IC runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via IRC channels.

Advanced
W32/Tilebot-IC is a worm with IRC backdoor functionality for the 
Windows platform.

W32/Tilebot-IC spreads to other network computers

- by exploiting common buffer overflow vulnerabilities, including: 
LSASS
(MS04-011), RPC-DCOM (MS04-012), PNP (MS05-039), WKS (MS03-049) and 
ASN.1
(MS04-007).
- through network shares.

W32/Tilebot-IC runs continuously in the background, providing a 
backdoor server which allows a remote intruder to gain access and 
control over the computer via IRC channels.

When first run W32/Tilebot-IC copies itself to \vcmon.exe.

The file vcmon.exe is registered as a new system driver service named 
"Windows
Security Manager", with a display name of "Windows Security Manager" 
and a
startup type of automatic, so that it is started automatically during 
system startup. Registry entries are created under:

HKLM\SYSTEM\CurrentControlSet\Services\Windows Security Manager

W32/Tilebot-IC sets the following registry entries, disabling the 
automatic startup of other software:

HKLM\SYSTEM\CurrentControlSet\Services\Messenger
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\RemoteRegistry
Start
4

HKLM\SYSTEM\CurrentControlSet\Services\TlntSvr
Start
4

Registry entries are set as follows:

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile
EnableFirewall
0

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
DoNotAllowXPSP2
1

HKLM\SOFTWARE\Microsoft\Ole
EnableDCOM
N

Registry entries are created under the following affecting system 
security:

HKLM\SOFTWARE\Microsoft\Security Center





Name   Troj/QQRob-ABQ

Type  
    * Spyware Trojan

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Steals information
    * Downloads code from the internet
    * Records keystrokes
    * Installs itself in the Registry

Aliases  
    * Trojan-PSW.Win32.Delf.nx
    * PWS-QQRob

Prevalence (1-5) 2

Description
Troj/QQRob-ABQ is a Trojan for the Windows platform.

Advanced
Troj/QQRob-ABQ is a Trojan for the Windows platform.

When run, Troj/QQRob-ABQ installs itself into the Windows folder as 
WUAUCLT.EXE, setting the following Registry entry to hook system 
startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft
(WinDir)\wuauclt.exe

Once running, Troj/QQRob-ABQ attempts to terminate several security 
products.

Troj/QQRob-ABQ also sets the following Registry entries:

HKCU\Software\Microsoft\Internet Explorer\New Windows
PopupMgr
"no"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
hx-1
"1"

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun
000000bd





Name   W32/Looked-BE

Type  
    * Virus

How it spreads  
    * Network shares
    * Infected files

Affected operating systems  
    * Windows

Side effects  
    * Downloads code from the internet
    * Installs itself in the Registry

Aliases  
    * Worm.Win32.Viking.bd

Prevalence (1-5) 2

Description
W32/Looked-BE is a virus.

W32/Looked-BE infects EXE files found on the infected computer and 
attempts to spread to remote network shares with weak passwords.

The virus includes functionality to access the internet and 
communicate with a remote server via HTTP.

Advanced
W32/Looked-BE is a virus.

W32/Looked-BE infects EXE files found on the infected computer and 
attempts to spread to remote network shares with weak passwords.

The virus includes functionality to access the internet and 
communicate with a remote server via HTTP.

When first run W32/Looked-BE copies itself to 
\uninstall\rundl132.exe and \logo1_.exe and creates 
\Dll.dll, which is also detected as W32/Looked-BE.

Many files with the name "_desktop.ini" are also created, in various 
folders on the infected computer. These files are harmless text files.

The following registry entry is created to run rundl132.exe on startup:

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
\uninstall\rundl132.exe

Registry entries are created under:

HKLM\SOFTWARE\Soft\DownloadWWW\





Name   W32/Rbot-FYF

Type  
    * Worm

How it spreads  
    * Network shares

Affected operating systems  
    * Windows

Side effects  
    * Turns off anti-virus applications
    * Allows others to access the computer
    * Downloads code from the internet
    * Reduces system security
    * Installs itself in the Registry
    * Exploits system or software vulnerabilities

Aliases  
    * Backdoor.Win32.Rbot.bpd

Prevalence (1-5) 2

Description
W32/Rbot-FYF is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-FYF spreads to other network computers by exploiting common 
buffer
overflow vulnerabilities, including: LSASS (MS04-011), WebDav 
(MS03-007) and
ASN.1 (MS04-007) and by copying itself to network shares protected by 
weak
passwords.

W32/Rbot-FYF runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

W32/Rbot-FYF includes functionality to terminate anti-virus and 
security
processes.

Advanced
W32/Rbot-FYF is a worm and IRC backdoor Trojan for the Windows 
platform.

W32/Rbot-FYF spreads to other network computers by exploiting common 
buffer
overflow vulnerabilities, including: LSASS (MS04-011), WebDav 
(MS03-007) and
ASN.1 (MS04-007) and by copying itself to network shares protected by 
weak
passwords.

W32/Rbot-FYF runs continuously in the background, providing a 
backdoor server
which allows a remote intruder to gain access and control over the 
computer via
IRC channels.

W32/Rbot-FYF includes functionality to terminate anti-virus and 
security
processes.

When first run W32/Rbot-FYF copies itself to 
\ssvvcchhoosst.exe.

The following registry entries are created to run ssvvcchhoosst.exe 
on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows Services Edt
ssvvcchhoosst.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
Microsoft Windows Services Edt
ssvvcchhoosst.exe

The following registry entries are set:

HKLM\SOFTWARE\Microsoft\Ole\Microsoft Windows Services Edt
ssvvcchhoosst.exe

HKLM\SYSTEM\ControlSet002\Control\Lsa\Microsoft Windows Services Edt
ssvvcchhoosst.exe

HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Microsoft Windows Services 
Edt
ssvvcchhoosst.exe





Name   Troj/Sharp-T

Type  
    * Trojan

Affected operating systems  
    * Windows

Side effects  
    * Reduces system security
    * Installs itself in the Registry

Prevalence (1-5) 2

Description
Troj/Sharp-T is a Trojan for the Windows platform.

Advanced
Troj/Sharp-T is a Trojan for the Windows platform.

When first run Troj/Sharp-T copies itself to 
\pchealth\csrss.exe and creates the file 
\drivers\oreans32.sys.

The file oreans32.sys is a component of a legitimate copy protection 
mechanism. It is not malicious.

The following registry entry is created to run Troj/Sharp-T on startup:

HKLM\SOFTWARE\Microsoft\Active Setup\Installed 
Components\{7DBBF5D8-5A0A-BA74-4E42-16BE17881CBC}
stubpath
\pchealth\csrss.exe s

The file oreans32.sys is registered as a new system driver service 
named "oreans32", with a display name of "oreans32".
Registry entries 
are created under:

HKLM\SYSTEM\CurrentControlSet\Services\oreans32

Registry entries are also created under:

HKCU\Software\Windows Update

 
--- MultiMail/Win32 v0.43