high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2006 (4.02) |
| Protection available since | 24 November 2005 04:02:27 (GMT) |
| Last updated | 20 December 2005 22:03:08 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/Lineage-OZ is a password stealing Trojan for the Windows platform.
Troj/Lineage-OZ includes functionality to email information to a predefined email address. The Trojan attempts to disable some security related applications so that this email activity is undected.
When first run Troj/Lineage-OZ copies itself to <System>\explorer.exe and creates the file <System>\ab1dll.dll.
The file ab1dll.dll, also detected as Troj/Lineage-OZ, is a component for logging both key presses and mouse operations. (This may, for example, be used to steal PIN numbers entered using the mouse on a virtual keypad.)
The following registry entry is created to run Troj/Lineage-OZ on startup:
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows
load
<System>\explorer.exe
|
