Internet Security Threats

Trojan-PSW.Win32.LdPinch.awp

RISK LEVEL:2

When launching, the Trojan decrypts its body to memory, and then:

• Searches the system for Kaspersky Anti-Virus and firewall warnings.It will then create a rule to allow the Trojan activity by simulating a clickon buttons within dialogue Windows.
• Collects data about the operating system version, system time,system folders, screen options, presence of an address book, accessible memory,account details of the current user, victim machine's network ID, and serialnumber of the hard disk. Also gets data about logical disks present on thesystem, their type and amount of free space, as well as a list of current processes.
• Harvests data from the configuration files of the following programs:
  • The Bat!
  • Mirabilis ICQ
  • Miranda
  • Trillian
  • Total Commander
  • Microsoft Outlook
  • CuteFTP
  • FAR
  • Opera
  • Mozilla Firefox
  • QIP
  • MailRu agent
  • Qualcomm Eudora
  • Punto Switcher
  • Gaim
  • Mozilla Firefox
  • FileZilla
  • FlashFXP
  • Passport.Net
  • &RQ

The Trojan sends harvest data in the form of a HTML request to ricoger.com:

http://ricoger.com/p1/****.php

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).
3. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).