TROJ_SWISYN.BY
ALIASES:
Kaspersky : Trojan.Win32.Swisyn.afrk; Sophos : Mal/VB-S
PLATFORM:
Windows 2000, XP, Server 2003
OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
Threat Type: Trojan
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
However, as of this writing, the said sites are inaccessible.
TECHNICAL DETAILS
File Size:
10/12/2009 bytes
File Type:
PE
Memory Resident:
Yes
Initial Samples Received Date:
12 Oct 2009
Arrival Details
However, as of this writing, the said sites are inaccessible.
Installation
This Trojan drops the following copies of itself into the affected system:
- %WINDOWS%\winlogon.exe
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
Winlogon = %WINDOWS%\winlogon.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
Winlogon = %WINDOWS%\winlogon.exe
Other Details
This Trojan connects to the following possibly malicious URL:
- http://{BLOCKED}ru.net/DATA
- http://{BLOCKED}ru.net/DOZ
- http://{BLOCKED}ru.net/SYN