Trojan-Clicker.Win32.Lopin

Class Trojan-Clicker
Platform Win32
Description

Technical Details

This TrojanClicker is written in Cbuilder.

Installation

When installed, the Trojan copies itself to the Windows system directory as rundll32.exe and registers this file in the system registry:

[HKLMSoftwareMicrosoftWindowsCurrentVersionRunControlPanel]

Payload

The Trojan changes the file msblank.htm in the Windows system directory.
Once altered, masblank.htm contains a link to the site cploving.awmhost.net. The user will always be directed to this site instead of being shown a blank page in Internet Explorer.