TROJ_SKYPLOD.A
Windows 2000, Windows XP, Windows Server 2003
Threat Type: Trojan
Destructiveness: No
Encrypted:
In the wild: Yes
OVERVIEW
This Trojan connects to certain websites to send and receive information.
TECHNICAL DETAILS
Installation
This Trojan drops the following copies of itself into the affected system:
- %Application Data%\Skype\SkypePM.exe
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
It creates the following folders:
- %Application Data%\Skype
(Note: %Application Data% is the current user's Application Data folder, which is usually C:\Windows\Profiles\{user name}\Application Data on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Application Data on Windows NT, and C:\Documents and Settings\{user name}\Local Settings\Application Data on Windows 2000, XP, and Server 2003.)
Autostart Technique
This Trojan adds the following registry entries to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Run
SkypePM = %Application Data%\Skype\SkypePM.exe
Other Details
This Trojan connects to the following website to send and receive information:
- {BLOCKED}turu.com
- {BLOCKED}urlan.com
- {BLOCKED}tamarsz.com
- {BLOCKED}ihadja.com
- {BLOCKED}tiopia.com
- {BLOCKED}turu.com
- {BLOCKED}urlan.com
- {BLOCKED}tamarsz.com
- {BLOCKED}ihadja.com
- {BLOCKED}tiopia.com