Virus:Trojan-PSW.Win32.Coced.220

• Technical details
• Payload
• Removal instructions

This Trojan is one of a family of Trojans which steals user passwords. It is designed to steal confidential data. It is a Windows PE EXE file. The file is 12,295 bytes in size. It is written in Visual C++.

Installation

Once launched, the Trojan copies its executable file to the Windows system directory:

The Trojan also extracts the following file from its body:

The Trojan changes the values of the following system registry keys:

[HKCU\Software\Mirabilis\ICQ\Agent\Apps\Run]
"Enable" = "yes"
"Path" = "<path to Trojan executable file>"
"Startup" = ""
"Parameters" = ""

[HKCU\Software\Mirabilis\ICQ\Agent]
"Launch Warning" = "No"

The Trojan harvests the paramenter values of the following registry sub-key:

The Trojan also harvests information about modem connections used by the system to access the Internet. It also harvests passwords to the modem connections by using WNetEnumCachedPasswords.

If CuteFTP is installed on the victim machine, the Trojan will harvest the contents of the following file:

The Trojan sends harvested data to the remote malicious user's email address. The Trojan uses mail.computer.com to send outgoing messages.

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following files:
   %Temp%\Naebi220.exe
   %System%\mswinrun.exe
4. Restore the original registry key values:
   [HKCU\Software\Mirabilis\ICQ\Agent\Apps\Run] [HKCU\Software\Mirabilis\ICQ\Agent] [HKCU\Software\Mirabilis\ICQ\Owners]
5. Update your antivirus databases and perform a full scan of the computer ( download a trial version of Kaspersky Anti-Virus).