Troj/Nethief-C

Discussion in 'malware problems & news' started by FanJ, Oct 25, 2002.

Thread Status:
Not open for further replies.
  1. FanJ

    FanJ Guest

    Name: Troj/Nethief-C
    Aliases: Backdoor.Nethief.XP.c, BackDoor-TW trojan,
    Backdoor.NetThief
    Type: Trojan
    Date: 25 October 2002


    At the time of writing Sophos has received just one report of
    this Trojan from the wild.

    Description
    Troj/Nethief-C is a backdoor Trojan that copies itself to IExplorer.exe in the
    Windows system folder and sets the registry entry

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Internet Explorer =
    Iexplorer.exe



    More information about Troj/Nethief-C can be found at
    http://www.sophos.com/virusinfo/analyses/trojnethiefc.html
     
    FanJ, Oct 25, 2002
    #1
  2. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    TDS detects 27 variants of Net Thief, it is used in Asia :)
     
    Gavin - DiamondCS, Oct 25, 2002
    #2
  3. Paul Wilders

    Paul Wilders Administrator

    Joined:
    Jul 1, 2001
    Posts:
    12,475
    Location:
    The Netherlands
    :) :)
     
    Paul Wilders, Oct 25, 2002
    #3
  4. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hmm Gavin you've been quite busy lately. Sophos writes about one with several names discovered today and you got 27 variants already!
    That it's using the iexplorer.exe name hmm people will not notice that too quickly as an illigal /infected variant of the legal exe.
     
    Jooske, Oct 26, 2002
    #4
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...