TrojanDropper:Win32/Syzor.A

TrojanDropper:Win32/Syzor.A is a trojan that disables several security programs and installs Backdoor:WinNT/Syzor.A onto the system.

TrojanDropper:Win32/Syzor.A disables the following antivirus and security products:

 

Win32/Syzor.A drops a randomly named kernel-mode driver into the Windows drivers folder as in the following example:

 

<system folder>\drivers\<random letters>.sys - detected as Backdoor:WinNT/Syzor.A

 

The registry is modified to run the dropped driver as a service that will also run in Windows Safe Mode.

 

Adds value: <random letters>

With data: <system folder>\drivers\<random letters>.sys

To these subkeys:

HKLM\System\CurrentControlSet\Services
HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal
HKLM\System\CurrentControlSet\Control\SafeBoot\Network
HKLM\System\ControlSet001\Services
HKLM\System\ControlSet001\Control\SafeBoot\Minimal
HKLM\System\ControlSet001\Control\SafeBoot\Network
HKLM\System\ControlSet002\Services
HKLM\System\ControlSet002\Control\SafeBoot\Minimal
HKLM\System\ControlSet002\Control\SafeBoot\Network

 

Win32/Syzor.A runs a command to make sure that any network traffic generated by a file named 'services.exe' passes through the firewall.