high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 13 April 2005 22:02:14 (GMT) |
| Last updated | 13 January 2006 10:33:39 (GMT) |
| Detected by | All Sophos products |
Sophos beta program
- Endpoint Security and Control 9.0
- Small business solutions 4.0
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Dloader-LN is a downloading Trojan for the Windows platform.
Troj/Dloader-LN drops a file named msmsgs.exe (also detected as Troj/Dloader-LN) in the Windows system folder and creates the following registry entries in order to be automatically run at logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
MSN Messenger
C:\WINDOWS\System32\msmsgs.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
notepad.exe
msmsgs.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\
Shell
Explorer.exe, msmsgs.exe
Troj/Dloader-LN checks that it is online then contacts three preconfigured websites in order to download a configuration file. This configuration file specifies a filename to download and execute.
Troj/Dloader-LN submits information about the infected machine, such as its language settings and IP address, to these websites using HTTP GET.
|
