high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 16 December 2005 21:54:36 (GMT) |
| Last updated | 27 March 2006 05:31:41 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Lewor-Q is a Trojan for the Windows platform.
Troj/Lewor-Q includes functionality to download, install and run new software.
When first run Troj/Lewor-Q copies itself to:
<Windows system folder>\impai.exe
<Windows system folder>\wnilogon.exe
Troj/Lewor-Q will also copy itself to several other files in the Windows folder. The filenames for these files are made up of a series of non-latin letters with a pif extension.
Troj/Lewor-Q creates the file <Windows system folder>\winsook.dll, also detected as Troj/Lewor-Q.
The following registry entry is created to run wnilogon.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SonudMan
<Windows system folder>\WNILOGON.exe
The following registry entry is set or modified, so that impai.exe is run when files with extensions of TXT are opened/launched:
HKCR\txtfile\shell\open\command
(default)
<Windows system folder>\impai.exe "%1"
|
