TROJ_ALUREON.SV

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It connects to certain websites to send and receive information.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Trojan drops the following files:

• %User Temp%\{random folder name 1}\{random folder name 2}\wow.ini

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It drops the following copies of itself into the affected system:

• %User Temp%\{random folder name 1}\{random folder name 2}\wow.dll
• {Malware Path and Filename}.exe:del

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

It creates the following folders:

• %User Temp%\{random folder name 1}\{random folder name 2}
• %User Temp%\{random folder name 1}

(Note: %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003, or C:\Users\{user name}\AppData\Local\Temp on Windows Vista and 7.)

Information Theft

This Trojan gathers the following data:

• Operating System
• Host CLSID

Other Details

This Trojan connects to the following website to send and receive information:

• {BLOCKED}pepp.com:80
• {BLOCKED}nggg.com:80
• {BLOCKED}.{BLOCKED}.232.20:80

NOTES:
It can execute certain malicious activities on the affected system, such as:

• Click Fraud
• Proxy Service