|Trojan.Linst attaches itself to Internet Explorer and sends information to a Web server.
When Trojan.Linst is executed, it does the following:
Creates the following files in the current folder, %Windir% and %System32%:
Zlib.dll: A legitimate library file
Groups.txt: A configuration file
Links.txt: A configuration file
HttpReq.dll: A legitimate library file
Dlinsth.dll: Detected as Trojan.Linst
Dlinst0.dll: Detected as Trojan.Linst
Bho.dll: An adware detected as Adware.IEHelperPage
Adds the value:
to the registry key:
so that the Trojan runs when you start Windows.
Loads the adware - Bho.dll.
Loads Dlinsth.dll that passes information back to http:/ /x-fuck.net, including:
- Software installed
- Environment variables
- System settings
Depending on the results returned by the Web server, advertisements may be displayed.
Use antivirus (also check How To Remove section)Startup Optimizer to remove it from startup.