Troj/Lewor-Q is a Trojan for the Windows platform.
Troj/Lewor-Q includes functionality to download, install and run new software.
When first run Troj/Lewor-Q copies itself to:
<Windows system folder>\impai.exe
<Windows system folder>\wnilogon.exe
Troj/Lewor-Q will also copy itself to several other files in the Windows folder. The filenames for these files are made up of a series of non-latin letters with a pif extension.
Troj/Lewor-Q creates the file <Windows system folder>\winsook.dll, also detected as Troj/Lewor-Q.
The following registry entry is created to run wnilogon.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SonudMan
<Windows system folder>\WNILOGON.exe
The following registry entry is set or modified, so that impai.exe is run when files with extensions of TXT are opened/launched:
HKCR\txtfile\shell\open\command
(default)
<Windows system folder>\impai.exe "%1"