Internet Security Threats

Trojan-Spy.Win32.Goldun.ms

RISK LEVEL:2

This Trojan steals confidential data. It is a Windows PE EXE file. The Trojancomponents vary in size from 39 to 48KB.

Installation

When launching, the Trojan extracts the following file from its body:

%System%\msvcrl.dll – this file is 39 424 bytes in size and is packedusing UPX.

The Trojan gets the path to Internet Explorer and modifies iexplore.exe, byadding an import from %System%\scvcrl.dll to the import table

This ensures that the Trojan file will be loaded every time Microsoft InternetExplorer is launched.

The original Trojan file will then be deleted.

The Trojan harvests passwords from the data files of the following instantmessenging clients:

QIP2005TrillianMSN MessengerYahoo MessengerAOLMiranda

The Trojan also harvests passwords to FTP servers from the configuration filesof the following FTP clients:

WS_FTPTotal CommanderCuteFTPFAR

It harvests account passwords from the configuration files of the followingmail clients:

TheBatOutlook ExpressOutlook

It also harvests the IE Auto Complete Fields dictionary.

The Trojan hooks the following API functions:

InternetReadFileInternetOpenURL

This enables it to track which sites a user visits. The Trojan also interceptsdata which is entered in web forms and transmitted in Internet Explorer.

In addition, when addresses are opened in Internet Explorer which coincidewith an address coded into the Trojan, the Trojan will redirect the browserto the remote malicious user’s site.

Harvested information will be sent in an HTTP request to the remote malicioususer's site.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Use Task Manager to terminate all iexplore.exe processes.
2. Delete the following file:

   %System%\msvcrl.dll

3. Restore the original iexplore.exe file using the Windows installationdisk.
4. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).