TrojanClicker.Win32.Lopi
Details
TrojanClicker.Win32.Lopin
This TrojanClicker is written in Cbuilder.
Installation
When installed, the Trojan copies itself to the Windows system directory as rundll32.exe and registers this file in the system registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ControlPanel]
Payload
The Trojan changes the file msblank.htm in the Windows system directory. Once altered, masblank.htm contains a link to the site cploving.awmhost.net. The user will always be directed to this site instead of being shown a blank page in Internet Explorer.
Related Posts