Troj/Danmec-B is a Trojan for the Windows platform.
When run, Troj/Danmec-B creates the following files:
<System>\checkreg.exe
<System>\iisload.dll
<System>\s32l.txt
<System>\ws386l.ini
<System>\wsl22764.dll
The files checkreg.exe, iisload.dll and wsl22764.dll are also detected by Sophos's Anti-Virus products as Troj/Danmec-B. The files s32l.txt and ws386l.ini are harmless data files and may be deleted.
The following registry entry is created in order to run checkreg.exe each time a user logs on:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
"<System>\checkreg.exe"
The Trojan opens a port and offers remote attackers the ability to route HTTP traffic through the infected computer. The Trojan may also download and install additional files.
Troj/Danmec-B may collect information from the infected computer and report it to a remote user. Information collected may include:
Information stolen from open applications
List of running processes
Folder and file listings
Network connections