| Description:
|
Details
TrojanClicker.Win32.Lopin
This TrojanClicker is written in Cbuilder.
Installation
When installed, the Trojan copies itself to the Windows system directory as rundll32.exe and registers this file in the system registry:
[HKLMSoftwareMicrosoftWindowsCurrentVersionRunControlPanel]
Payload
The Trojan changes the file msblank.htm in the Windows system directory. Once altered, masblank.htm contains a link to the site cploving.awmhost.net. The user will always be directed to this site instead of being shown a blank page in Internet Explorer. |
