Troj/WLHack-A is a Trojan for the Windows platform.
Troj/WLHack-A is a hacked version of <System>\winlogon.exe, which is a legitimate Windows system file.
When executed on startup as a replacement to the original winlogon.exe, Troj/WLHack-A will attempt to load malicious code from either one of the following files:
- ws2_32.dll:fork2
- wsys.dll
The file ws2_32.dll:fork2 is an Alternate Data Stream of the legitimate Windows system file ws2_32.dll.