Description
Troj/Femad-L is a Trojan for the Windows platform. In order to run automatically when Windows starts up Troj/Femad-L creates the following registry entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
sys= "regedit -s sysdllwm.reg"
Troj/Femad-L downloads two files. The first is saved as WINLOGON.EXE or QTTASKS.EXE and run. The other is a set of additional registry entries which are inserted by the first entry added (above).
These registry entries change the Internet Explorer Home page and Search page to advertising sites in the riviera.cc domain.
Troj/Femad-L may also submit information about the infected machine, such as the IP address, the serial number of the C:\ drive and the current username.
This Trojan may also attempt to post to adult web sites.
Recovery
Please follow the instructions for removing Trojans.
Change any data that may have become compromised.
You should also change your Internet Explorer settings using Tools|Internet options|General to remove any modifications made by the Trojan.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
sys= "regedit -s sysdllwm.reg"
and delete it if it exists.
Close the registry editor.
