Upon execution, this malware drops a file on the root directory of the C: drive:

• C:xp2007.dat
  - Detected as Trojan-PSW.Win32.Lmir.bpg

This malware installs itself as a Browser Helper Object. It creates the following autostart registry keys:

• HKLMSoftware{5FF908C9-578F-4A40-9643-E0CA07093990}
• HKLMSoftwareClassesCLSID{5FF908C9-578F-4A40-9643-E0CA07093990}
• HKLMSoftwareClassesCLSID{5FF908C9-578F-4A40-9643-E0CA07093990}InprocServer32
• HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects
  {5FF908C9-578F-4A40-9643-E0CA07093990}

This malware logs keyboard strikes and mouse clicks of the user and then saves them in a file with a random name in the system's default temporary directory. It also logs the URLs (web site addresses) visited by the user and saves them in a separate log file, also with a random name.

Note: The temporary directory is normally C:Documents and Settings[account name]Local SettingsTemp.

Last update 07 December 2007

 

TOP