Trojan Allows Unauthorized Computer Access

Troj/Prorat-D is a backdoor Trojan that may allow unauthorized access and control of the computer from a remote network location.

Upon execution, Troj/Prorat-D drops copies of itself into the Windows System or System32 folder using one or more of the filenames FSERVICE.EXE, FFSERVICE.EXE, DSERVICE.EXE, LSERVICE.EXE, SSERVICE.EXE and WSERVICE.EXE.

Troj/Prorat-D adds the following registry entries so that it is run on startup:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Reg Services = C:\\
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
Windows Reg Services = C:\\
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\
Shell = Explorer.exe C:\\
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\
Windows Reg Services = C:\\
DirectX for Microsoft Windows = C:\\
HKLM\Software\Microsoft\Active Setup\Installed Components\
[A75aed00-d7bf-11d1-9947-00c0Cf98bbc9]\
StubPath = C:\\
HKLM\Software\Microsoft\Active Setup\Installed Components\
[5Y99AE78-58TT-11dW-BE53-Y67078979Y]\
StubPath = C:\\

This Trojan may also attempt to download and install the file http://members.lycos.co.uk/kabloboy/XP_Update v1.5.3.exe. This will be copied into the Windows folder under WINLOGON.EXE.

This program will drop the file WINKEY.DLL into the Windows System folder and create the following registry entry:

HKCU\Software\Microsoft DirectX\WinSettings\
Troj/Prorat-C is embedded within WINKEY.DLL.

More information is at this Sophos page.

Worm Uses Outlook, mIRC or File Sharing to Spread

W32.HLLW.RedDw@mm is a worm that spreads by email using Microsoft Outlook, by mIRC, or by peer-to-peer file sharing. The scripts dropped by this worm, are detected as BAT.RedDw@mm.

More information is at this Symantec page.

Trojan Sends Spam Mail From Microsoft

Spy-Idwi is a Trojan with multiple versions. This family bears similarity to Spy-Tofger, bearing the following characteristics: