high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 11 January 2006 05:57:33 (GMT) |
| Last updated | 27 January 2006 02:39:29 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Lineage-DY is a password stealing Trojan for the Windows platform.
When first run Troj/Lineage-DY copies itself to <System>\Kerne1211.exe and
creates the following files:
\%CurrentFolder%\gg.bat
<System>\RegistryInfo.dll
<System>\microsoftie1211.dll
gg.dat is a harmless file. RegistryInfo.dll and microsoftie1211.dll are
detected as Troj/Lineage-DY.
The following registry entry is created to run Kerne1211.exe on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<System>\Kerne1211.exe
The file RegistryInfo.dll is registered as a COM object and ShellExecute hook,
creating registry entries under:
HKCR\CLSID\(3EA18648-FAF6-490D-9C92-8FD729028A58)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
ShellExecuteHooks\(3EA18648-FAF6-490D-9C92-8FD729028A58)
|
