high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | November 2005 (3.99) |
| Protection available since | 18 September 2005 15:30:09 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/LegMir-JB is a Trojan for the windows platform.
The Trojan attempts to steal information (eg passwords) entered into the windows of other applications (eg FSOnline). The target file for stolen information is C:\gamesfs.txt. The Trojan then attempts to email this file to a remote location. Troj/LegMir-JB is a Trojan for the windows platform.
The Trojan attempts to steal information (eg passwords) entered into the windows of other applications (eg FSOnline). The target file for stolen information is C:\gamesfs.txt. The Trojan then attempts to email this file to a remote location.
When first run Troj/LegMir-JB copies itself to <Windows>\inf\rundll32.exe and creates the file <System>\fsdll.dll.
The following registry entry is created to run rundll32.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
loadMefs
<Windows>\inf\rundll32.exe
Troj/LegMir-JB attempts to terminate and uninstall the following anti-virus and security processes:
PasswordGuard.exe
RavMon.exe
ZoneAlarm
eghost.exe
iparmor.exe
kavpfw.exe
mailmon.exe
|
