Troj/Dloader-LN is a downloading Trojan for the Windows platform.
Troj/Dloader-LN drops a file named msmsgs.exe (also detected as Troj/Dloader-LN) in the Windows system folder and creates the following registry entries in order to be automatically run at logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
MSN Messenger
C:\WINDOWS\System32\msmsgs.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
notepad.exe
msmsgs.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Shell
Explorer.exe, msmsgs.exe
Troj/Dloader-LN checks that it is online then contacts three preconfigured websites in order to download a configuration file. This configuration file specifies a filename to download and execute.
Troj/Dloader-LN submits information about the infected machine, such as its language settings and IP address, to these websites using HTTP GET.