Printer Friendly Page

Discovered: June 15, 2004
Updated: June 16, 2004 12:15:21 AM
Systems Affected: Windows

Trojan.Boxed.A is a trojan that attempts to perform a Denial of Service attack on certain websites. It also terminates services associated with antivirus software, and denies access to antivirus websites.

Technical Description

When run, Trojan.Boxed.A attempts to delete the following services:
Symantec Core LC
Network Client
Network Client Monitor

It then sets itself to run as a service with the name "nwclnt", and the display name "Network Client". This service will automatically run at startup.

It performs a Denial of Service attack on the following websites:

It replaces the existing %System%\drivers\etc\hosts file with one that contains the following text, so that any attempts to connect to these Web sites will fail: