Нужен совет? Обратитесь за помощью к сообществу или специалистам.
Перейти к Avira Answers
Alias:Trojan-PSW.Win32.Lineage.hc (Kaspersky)
Type:Worm 
Size:26.624 bytes 
Origin: 
Date:06-22-2005 
Damage: 
VDF Version:6.31.0.62 
Danger:Low 
Distribution:Low 

General DescriptionAffected Platforms:
*Windows 95
*Windows 98
*Windows ME
*Windows NT
*Windows 2000
*Windows XP
*Windows Server 2003

Technical DetailsTechnical Details*
TR/PSW.Lineage.HC.1 is packed with runtime packer ASPack.
It is able to steal account and password information.
If executed, it creates the following file:
<%sysDIR%>\Syshlp.dll (sizer: 32.768 bytes)
which is detected as TR/PSW.Lineage.HC.2 by AVIRA.

It creates the following registry keys:

[HKEY_CLASSES_ROOT\Interface\{E9F0AA4D -3233-40CF-8033-A02EAAB0BA70}]

[HKEY_CLASSES_ROOT\TypeLib\{0AB57312-F F76-405E-9013-C6244D31AE2D}\1.0]

[HKEY_CLASSES_ROOT\CLSID\{1E6918EA-351 F-4501-A346-2942144DE626}]

[HKEY_CLASSES_ROOT\Syshlp.bho]

[HKEY_CLASSES_ROOT\Syshlp.bho.1\CLSID]

Having these Browser Helper Object registry entries set the trojan can be active in Internet Explorer.

It sends the stolen information to the the following email addresses:
<mailto:koreanlin@tom.com>koreanlin@tom.com
<mailto:koreanhangame@tom.com>koreanhangame@tom.com
<mailto:koreanpmang@tom.com>koreanpmang@tom.com
Описание добавил Crony Walker в(о) вторник, 15 июня 2004 г.

Назад . . . .
https:// Это окно зашифровано для вашей безопасности.