Troj/Lohav-J is a proxy backdoor Trojan. The Trojan copies itself and two
additional files 'iinj4.exe' and 'system.exe' into the Windows System folder.
These files are both detected as Troj/Lohav-A.
In order to run automatically when Windows starts up, the Trojan creates
the following registry entry:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssgrate.exe
=<SYSTEM>\irun4.exe
where <SYSTEM> is the Windows System folder.
The following registry entries are also created:
HKCU\SOFTWARE\DateTime\uid = <number>
HKCU\SOFTWARE\DateTime\port = <listening port number>
HKCU\SOFTWARE\DateTime\frun = 1
Troj/Lohav-J registers the infected machine with a number of websites.
The Trojan routes internet traffic from other computers via the proxy
component and can be used to forward SPAM email.
Troj/Lohav-J attemps to terminate various security-related applications.
Troj/Lohav-J may attempt to download further files.