| Port No | 7597 |
| Service Name | QAZ Trojan |
| RFC Doc | 0 |
| Protocol | UDP |
| Description | QAZ Trojan is the trojan believed to have infected Microsoft. When analyzing the file we found references to move notepad.exe to note.com and name the trojan itself to notepad.exe. However, upon actual testing our version of the QAZ Trojan, it did not replace the notepad.exe. So, if you have a note.com file it probably is your real notepad.exe. Once the QAZ Trojan has infected one computer it looks for other shared hard drives and attempts to infect them. It then emails to a Russian address and waits for a connection |
| Reference Link | QAZ Trojan |
| Attack | It Autoloads: Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Key: startIE Features: Upload and run file Fix: Rember the value (file path) of the startIE key in the registry located at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and then remove the startIE key. Which can be done with regedit or any other registry editing program. Reboot the computer or close the file listed in the startIE registry key. Delete the trojan file listed in the startIE registry key. |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.