Troj/Danmec-B

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

Windows NT/2000/XP/2003

In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
"<System>\checkreg.exe"

and delete it if it exists.

Close the registry editor.

Troj/Danmec-B is a Trojan for the Windows platform.

When run, Troj/Danmec-B creates the following files:

<System>\checkreg.exe
<System>\iisload.dll
<System>\s32l.txt
<System>\ws386l.ini
<System>\wsl22764.dll

The files checkreg.exe, iisload.dll and wsl22764.dll are also detected by Sophos's Anti-Virus products as Troj/Danmec-B. The files s32l.txt and ws386l.ini are harmless data files and may be deleted.

The following registry entry is created in order to run checkreg.exe each time a user logs on:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Registry Startup Check
"<System>\checkreg.exe"

The Trojan opens a port and offers remote attackers the ability to route HTTP traffic through the infected computer. The Trojan may also download and install additional files.

Troj/Danmec-B may collect information from the infected computer and report it to a remote user. Information collected may include:

Information stolen from open applications
List of running processes
Folder and file listings
Network connections