Home Malware Programs Trojans Stwoyle

Stwoyle

Posted: July 6, 2006

Stwoyle is a trojan that installs as Browser Helper Object and sends system information to remote server. Stwoyle generates error messages that interrupts all running processes every few seconds. Once Stwoyle excutes, programs can not be run continuously making regular computer functionality impossible. Stwoyle may also connect to predetermined web servers to transfer stolen system information.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 adsldpbj.dll
    2 st3.dll
    3 winstyle2.dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\style2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Notify\style2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowserHelper
  • The following CLSID's were detected:
    HKEY..\..\{CLSID Path}6AC3806F-8B39-4746-9C38-6B01CB7331FF
Loading...