TSPY_INJECT.AQH

This spyware may be dropped by other malware. It may be unknowingly downloaded by a user while visiting malicious websites.

It connects to certain websites to send and receive information.

Arrival Details

This spyware may be dropped by other malware.

It may be unknowingly downloaded by a user while visiting malicious websites.

Installation

This spyware drops the following copies of itself into the affected system:

• %System%\lxb.exe

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

It is injected into the following processes running in memory:

• EXPLORER.EXE
• MSNMSGR.EXE

Autostart Technique

This spyware adds the following registry entries to enable its automatic execution at every system startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Active Setup\Installed Components\{7695D83A-2E43-31BA-6675-9169E22C57F1}
StubPath = %System%\lxb.exe

Dropping Routine

This spyware drops the following files wherein it saves the information it gathers:

• %System%\lxb

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

Other Details

This spyware connects to the following website to send and receive information:

• {BLOCKED}a.dd.{BLOCKED}ine.be

It does the following:

• This malware monitors user activities and logs messages posted to the system message queue including keystrokes in order to steal user information such as user names and passwords.