Trojan.PSW.LdPinch.ht

Installation to system

When the open.exe file is started it first disables 2 services belonging to an anti-virus and a firewall:

kavsvc
 outpostfirewall

Then the trojan starts several threads. One of the threads monitors and kills processes if their names contain any of the following substrings:

outpost.exe
 VSMON.exe
 ZAPRO.exe
 APVDWIN.exe
 PAVSRV51.exe
 NOD32KUI.exe
 avpcc.exe
 defwatch.exe

To the Windows Explorer and Internet Explorer 'Favourites' menu the trojan adds shortcuts to the following websites:

xakepy.ru
 carotid.ru

Additionally the trojan adds itself to the authorised applications list for Windows firewall. As a result of this modifiction, Windows allows the trojan to access Internet and does not inform a user that a third-party application asks for Internet Access.

Finally the trojan copies itself to Windows folder as 'csrss.exe' file, runs that file and terminates its own process. The trojan also drops a small DLL file with the name 'syslg.dll' to Windows folder. It registers this DLL as a shell service object with a unique CLASSID and as a result, this DLL is loaded every time Windows starts. The DLL works as a starter for the main trojan's file.

Ftp, Proxy and Backdoor

Being active, the trojan starts an ftp server on TCP port 2121. The server requires a user and a password. When correct user and password is supplied the server gives access to all drives on an infected computer.

The trojan also starts a proxy server on TCP port 2355. This proxy can be used by spammers and the internal name of the trojan 'Spam Pinch 2 DE' suggests that it was primarily created for that purpose.

One more important feature of the trojan is to start a backdoor on TCP port 2050. When connected to this port, a remote user gets a command shell to an infected computer.

The trojan notifies its author from infected computers by accessing a webnomey.net website with a specially constructed URL, that contains a computer's IP address, proxy port, ftp port and backdoor shell port.

Stealing Data

The trojan reads settings of different applications and steals web, ftp and e-mail server addresses, logins and passwords. The following applications are affected:

ICQ
 Miranda ICQ
 &RQ
 The Bat!
 Becky
 CuteFTP
 Edialer
 Far Manager
 Mozilla
 Opera
 Internet Explorer
 Outlook
 Outlook Express
 Trillian
 WS_FTP
 Total Commander

The trojan also steals RAS (dialup) phone numbers, logins and passwords and collects system information about an infectected computer.