Trojan is proactively detected as Mal/Dropper-L so customers are already protected. The Trojan drops two rootkit components (already detected as Troj/NTRootK-BY) designed to stealth its subsequent downloading activity. In the past 5 days, SophosLabs have already harvested 6 different binaries (all variants of this same dropper) In the last 5 days since the Trojan was published, we have already found 6 different variants of the same Trojan. This case provides a perfect example how important it is to continually improve generic detections to combat current and persistent threats.”]
Source: https://nakedsecurity.sophos.com/2007/08/08/tomb-raider-strikes-back/