Home Malware Programs Trojans PWSteal.Lineage

PWSteal.Lineage

Posted: June 6, 2006

Threat Metric

Threat Level: 8/10
Infected PCs: 133
First Seen: July 24, 2009
Last Seen: April 28, 2023
OS(es) Affected: Windows

PWSteal.Lineage is an application that will attempt to steal passwords to the "Lineage" online game. Once it has intercepted your password, PWSteal.Lineage will transmit this to the creator of the Trojan. PWSteal.Lineage may also modify your Windows host file in order to redirect your access to computer security websites.

Aliases

Trj/Lineage.AHR [Panda]PSW.Agent.BNK [AVG]Lineage!tr.pws [Fortinet]Trojan-PWS.Win32.Mefs [Ikarus]Trojan.Win32.Generic!BT [Sunbelt]Dropper/LineageHack.41537 [AhnLab-V3]Trojan/Win32.Agent [Antiy-AVL]Win32/Lineage.HD [eTrust-Vet]Mal/Packer [Sophos]Heuristic.BehavesLike.Win32.Packed.A [McAfee-GW-Edition]Mal_Lineage [TrendMicro]TR/PSW.Lineage.WO [AntiVir]Heur.Packed.Unknown [Comodo]Trojan.PWS.Lineage.KD [BitDefender]Worm.Mytob-73 [ClamAV]
More aliases (107)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



tavo0.dll File name: tavo0.dll
Size: 81.4 KB (81408 bytes)
MD5: dcd5be4f0c1ffe5d3803c7dd8f55f6aa
Detection count: 95
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: December 11, 2009
ztdll.dll File name: ztdll.dll
Size: 45.56 KB (45568 bytes)
MD5: d0df75b279b3c95cd976167623349262
Detection count: 95
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: December 11, 2009
kavo1.dll, kavo0.dll File name: kavo1.dll, kavo0.dll
Size: 165.88 KB (165888 bytes)
MD5: dba7d7a7315453e61dcb381c34612931
Detection count: 82
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: December 11, 2009
fvbk.exe, kavo.exe File name: fvbk.exe, kavo.exe
Size: 109.91 KB (109916 bytes)
MD5: a607ace355134ab1e1e5d503b315e50f
Detection count: 71
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009
tavo1.dll File name: tavo1.dll
Size: 81.4 KB (81408 bytes)
MD5: fbdaff19d8020342444a4bd2511e7aa5
Detection count: 60
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: December 11, 2009
umsnvc[1].exe File name: umsnvc[1].exe
Size: 740.35 KB (740352 bytes)
MD5: d3dbd8620baf8f7f42f0f99ba3c78833
Detection count: 51
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: April 22, 2010
cc[1].exe File name: cc[1].exe
Size: 123.9 KB (123904 bytes)
MD5: 91baf7aa8e72bde314231e3c3f10b24f
Detection count: 36
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009
ff[1].exe File name: ff[1].exe
Size: 132.6 KB (132608 bytes)
MD5: 11f0a5bbb8f58e6f2e186af84032373c
Detection count: 32
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: December 11, 2009
%WINDIR%\system32\explorer.exe File name: explorer.exe
Size: 41.53 KB (41537 bytes)
MD5: 4093f4a22f3862548770f75c0a426000
Detection count: 23
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 10, 2022
%WINDIR%\winlogin.exe File name: winlogin.exe
Size: 93.18 KB (93184 bytes)
MD5: d83e250ce2876d238e3808be0b61ec8f
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%
Group: Malware file
Last Updated: October 15, 2012
xydll.dll File name: xydll.dll
Size: 38.91 KB (38912 bytes)
MD5: 7bba97d1aae338bccffb88e09c0f7d4c
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Group: Malware file
Last Updated: December 11, 2009

More files

Registry Modifications

The following newly produced Registry Values are:

File name without path1[1].exeRun keysNewmanTray

Additional Information

The following URL's were detected:
orc10.com

Related Posts

Loading...