Troj/Lineage-DY is a password stealing Trojan for the Windows platform.
When first run Troj/Lineage-DY copies itself to <System>\Kerne1211.exe and
creates the following files:
\%CurrentFolder%\gg.bat
<System>\RegistryInfo.dll
<System>\microsoftie1211.dll
gg.dat is a harmless file. RegistryInfo.dll and microsoftie1211.dll are
detected as Troj/Lineage-DY.
The following registry entry is created to run Kerne1211.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<System>\Kerne1211.exe
The file RegistryInfo.dll is registered as a COM object and ShellExecute hook,
creating registry entries under:
HKCR\CLSID\(3EA18648-FAF6-490D-9C92-8FD729028A58)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
ShellExecuteHooks\(3EA18648-FAF6-490D-9C92-8FD729028A58)