Overall risk rating:

Reported detections:

System  impact:

Information exposure:

Description:

This spyware arrives on a system either downloaded from the Internet or dropped by JS_AGENT.AAQI.

When executed, it drops a .DLL component in the current user's Temporary folder. It then uses the said .DLL component for its keylogging routine.

This spyware also creates a registry entry to ensure its automatic execution at every system startup.

On systems running Windows 95, 98, and ME, however, this spyware moves certain legitimate files from their respective locations to the root folder and replaces them with copies of itself.

This spyware monitors the Internet Explorer activities of an affected system. It steals account-related information like user names and passwords every time a user visits the Web site of the popular online game, Lineage. It does this routine by logging user keystrokes and then writing its stolen information to a file, which in turn is read and whose contents are posted on a certain Web site. Thus, the stolen information becomes available to remote users who know of the posting Web site.

For additional information about this threat, see:
Solution
Technical Details

Description created: Jul 12, 2007