PCの修理が必要ですか?
専門家に頼む
Alias:Trojan-PSW.Win32.Lineage.hc (Kaspersky)
Type:Worm 
Size:26.624 bytes 
Origin: 
Date:06-22-2005 
Damage: 
VDF Version:6.31.0.62 
Danger:Low 
Distribution:Low 

General DescriptionAffected Platforms:
*Windows 95
*Windows 98
*Windows ME
*Windows NT
*Windows 2000
*Windows XP
*Windows Server 2003

Technical DetailsTechnical Details*
TR/PSW.Lineage.HC.1 is packed with runtime packer ASPack.
It is able to steal account and password information.
If executed, it creates the following file:
<%sysDIR%>\Syshlp.dll (sizer: 32.768 bytes)
which is detected as TR/PSW.Lineage.HC.2 by AVIRA.

It creates the following registry keys:

[HKEY_CLASSES_ROOT\Interface\{E9F0AA4D -3233-40CF-8033-A02EAAB0BA70}]

[HKEY_CLASSES_ROOT\TypeLib\{0AB57312-F F76-405E-9013-C6244D31AE2D}\1.0]

[HKEY_CLASSES_ROOT\CLSID\{1E6918EA-351 F-4501-A346-2942144DE626}]

[HKEY_CLASSES_ROOT\Syshlp.bho]

[HKEY_CLASSES_ROOT\Syshlp.bho.1\CLSID]

Having these Browser Helper Object registry entries set the trojan can be active in Internet Explorer.

It sends the stolen information to the the following email addresses:
<mailto:koreanlin@tom.com>koreanlin@tom.com
<mailto:koreanhangame@tom.com>koreanhangame@tom.com
<mailto:koreanpmang@tom.com>koreanpmang@tom.com
説明の挿入者 Crony Walker の 2004年6月15日火曜日

戻る . . . .

© 2013 Avira Operations GmbH & Co. KG. All rights reserved.

マイアカウント

https:// このウィンドウは暗号化されています。