This Trojan is a modified Windows %System%\drivers\etc\hosts file, which is used to map domain names (DNS) to IP addresses. The modified file is 100 bytes in size. The file is modified in such a way as to prevent the user from viewing www.webmoney.ru.

The following strings are added to the hosts…

Related Posts

This entry was posted on Wednesday, May 30th, 2007 at 4:57 am and is filed under Virus Threats.