Detection added	Mar 29 2009
Update released	Mar 29 2009 20:47 GMT
Description added	Apr 15 2009

• Technical details
• Payload
• Removal instructions

This Trojan has a malicious payload. It is a Windows PE EXE file. It is 23552 bytes in size.

Installation

The Trojan copies its executable file as follows:

In order to ensure that the Trojan is launched automatically when the system is rebooted, the Trojan adds a link to its executable file in the system registry:

The Trojan adds its executable file to the Windows firewall list of trusted applications. It then launches the “iexplore.exe” process and injects its code into this process.

It also attempts to terminate the following processes:

avesvc.exe
ashdisp.exe
avgrsx.exe
bdss.exe
spider.exe
avp.exe
nod32krn.exe
cclaw.exe
dvpapi.exe
ewidoctrl.exe
mcshield.exe
pavfires.exe
almon.exe
ccapp.exe
pccntmon.exe
fssm32.exe
issvc.exe
vsmon.exe
cpf.exe
ca.exe
tnbutil.exe
avp.exe
mpfservice.exe
npfmsg.exe
outpost.exe
tpsrv.exe
pavfires.exe
kpf4ss.exe
persfw.exe
vsserv.exe
smc.exe

It also attempts to disable the following services associated with antivirus and firewall programs:

The Trojan also harvests passwords to web sites saved to the cache of the browsers shown below:

It also harvests passwords and account data for the following IM clients:

Trillian
Miranda
Yahoo Messenger
MySpace IM
Gaim

The Trojan has a built-in keylogger and can make screenshots of the user’s desktop. These screenshots are saved to the Temporary directory as <N> with <N> being a decimal number.

Harvested data is sent to the malicious user’s server:

Propagation via removable media

The Trojan copies its executable file to the root of each removable drive under the following name:

<X>:\wlan.exe, with X being the disk

In addition to its executable file, the Trojan also places the file shown below in the root directory of every disk:

This file will launch the Trojan executable file each time the user opens an infected disk using Explorer.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the malicious program’s process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following system registry key parameter:
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "WSVCHO" = "%WinDir%\system\svhost.exe"
4. Delete the following file:
   %WinDir%\system\svhost.exe
5. Empty the temporary directory (%Temp%).
6. Delete the files shown below from all removable storage media:
   <X>:\autorun.inf
   <X>:\wlan.exe,
   with X being the disk
7. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).