Virus:Trojan-PSW.Win32.Coced.215

Other versions: .219 , .219.b , .220

Aliases
Trojan-PSW.Win32.Coced.215  ( Kaspersky Lab ) is also known as: Trojan.PSW.Coced.215 ( Kaspersky Lab ), IRC/Pws.gen ( McAfee ),   PWSteal.Trojan ( Symantec ),   Trojan.PWS.Coced.215 ( Doctor Web ),   Troj/Coced ( Sophos ),   PWS:Win32/Coced.2_15 ( RAV ),   TROJ_NBI.215 ( Trend Micro ),   TR/Coced-215 ( H+BEDV ),   W32/Trojan.Coced.215 ( FRISK ),   Win95:Lenin ( ALWIL ),   Trojan.Coced.215 ( SOFTWIN ),   Trojan.PSW.Coced.215 ( ClamAV ),   Trj/Coced.215 ( Panda ),   Naebi.2_15b ( Eset )
Description added Feb 19 2007
Behavior PSW Trojan
Technical details

This Trojan steals user passwords. It is designed to steal a range of confidential information. It is a Windows PE EXE file. It is 10,240 bytes in size. It is written in Visual C++.

Installation

Once launched, the Trojan copies its executable file to the Windows system directory:

%System%\msdll32.exe
Payload

The Trojan changes the values of the following system registry keys:

[HKCU\Software\Mirabilis\ICQ\Agent\Apps\ICQ]
"Enable" = "yes"
"Path" = "<path to Trojan exeuctable file>"
"Startup" = ""
"Parameters" = ""

[HKCU\Software\Mirabilis\ICQ\Agent]
"Launch Warning" = "No"

The Trojan harvests the paramenter values of the following registry sub-key:

[HKCU\Software\Mirabilis\ICQ\Owners]

The Trojan also harvests information about modem connections used by the system to access the Internet. It also harvests passwords using WNetEnumCachedPasswords. The Trojan sends the harvested data to the remote malicious user's email: lenin****@usa.net . The Trojan uses mail.compuserve.com to send outgoing mail.

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

  1. Use Task Manager to terminate the Trojan process.
  2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
  3. Delete the following system registry key parameters:

    [HKCU\Software\Mirabilis\ICQ\Agent\Apps\ICQ]
    "Enable"="yes"
    "Path"="<path to Trojan executable file>"
    "Startup"=""
    "Parameters"=""

    [HKCU\Software\Mirabilis\ICQ\Agent]
    "Launch Warning"="No"

  4. Delete the file created by the Trojan:
    %System%\msdll32.exe
  5. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).
HOME