Troj/Lineage-L

Aliases	TROJ_LINEAGE.Q Trojan-PSW.Win32.Lineage.ah
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	June 2005 (3.94)
Protection available since	2 May 2005 07:53:39 (GMT)
Detected by	All Sophos products

Troj/Lineage-L is a password stealing Trojan for the Windows platform that attempts to steal passwords associated with the game called "Lineage".

Troj/Lineage-L will copy itself to the Windows system folder explorer.exe

Troj/Lineage-L will also create a DLL in the Windows system folder named htdll.dll.

Troj/Lineage-L searches for the "Lineage","Lineage Windows Client" window in attempt to initiate a keylogging routine.

In order to be able to run automatically when Windows starts up Troj/Lineage-L sets the registry entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
loadMect1
C:\Program Files\explorer.exe

Troj/Lineage-L will attempt to disable a number of anti-virus and security related processes and windows, including:

EGHOST.EXE
MAILMON.EXE
KAVPFW.EXE
IPARMOR.EXE
RavMon.exe
ZoneAlarm

Troj/Lineage-L may attempt to modify wininit.ini and add an entry pointing to the Trojan to ensure it runs on Windows startup.

Get reports about the latest virus and spyware threats delivered to your computer