Internet Security Threats

Trojan-Spy.Win32.PcGhost.400

RISK LEVEL:2

This Trojan is designed to steal confidential data. It is a Windows PE EXEfile. It is written in Delphi. It is 273,920 bytes in size.

Installation

This Trojan will be installed to the victim machine by another malicious program.

The Trojan is configured using a Trojan spy construction program.

When launching, the Trojan loads a file called pcmsg.dll. This is used toharvest information from the system.

The Trojan creates the following system registry key:

[HKLM\Software\Sun\pcGhost]

The Trojan will also check the registry for the following key:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]"PcGhost"

The Trojan also creates a unique identifier, “pcGhost”, to flagits presence in the system:

pcGhost

The Trojan performs the following actions.

• makes screenshots;
• logs keystrokes;
• tracks mouse movement;
• logs sites visited;
• provides the option to indicate a specific window within whichactivity will be tracked.

Harvested data will be sent to the address specified by the remote malicioususer.

If your computer does not have an up-to-date antivirus, or does not have anantivirus solution at all, follow the instructions below to delete the maliciousprogram:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend onhow the program originally penetrated the victim machine).

   PcGhost.exe

3. Delete the following registry keys:

   [HKLM\Software\Sun\pcGhost][HKLM\Software\Microsoft\Windows\CurrentVersion\Run]"PcGhost"

4. Update your antivirus databases and perform a full scan of thecomputer (download a trial version of Kaspersky Anti-Virus).