high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Protection available since | 22 June 2005 11:40:24 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entries:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
and remove any reference to any file you deleted.
Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entry:
HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\
and remove any reference to any file you deleted.
Close the registry editor.
More Information
Troj/Lydra-B is a Trojan for the Windows platform.
Troj/Lydra-B has password stealing capabilities.
When Troj/Lydra-B is run, it copies itself to the following locations:
<Startup>\msoffice.scr
<Windows>\calc.exe
<Windows>\internat.exe
<Windows>\lsass32.exe
<Windows>\regedit.exe
<Windows>\userun32.exe
The following registry entries are created to run Troj/Lydra-B on startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
internat
<Windows>\internat.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
userun32
<Windows>\userun32.exe
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
lsass32
<Windows>\lsass32.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
internat
<Windows>\internat.exe
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
internat
<Windows>\internat.exe
The file internat.exe is registered as a new system driver service named "internat", with a display name of "TCPIP route manager" and a startup type of automatic, so that it is started automatically during system startup. Registry entries are created under:
HKLM\SYSTEM\CurrentControlSet\Services\internat\
|
