This Trojan is a modified Windows %System%\drivers\etc\hosts file, which is used to translate domain names (DNS) to IP addresses. The file is modified in such a way as to prevent the user from viewing the sites listed below.

The following strings are added to the hosts file.

# System Hosts…

Related Posts

This entry was posted on Tuesday, November 28th, 2006 at 10:31 am and is filed under Virus Threats.