Trojan-GameThief.Win32.Nilage.a

Technical Details

This Trojan is one of a family of Trojans which steals user passwords. It is a Windows PE EXE file. It is 52 925 bytes in size. It is packed using FSG.

Installation

When launched, the Trojan copies its executable file to the following directory:

The Trojan also extracts the following .dll file from its body:

In order to ensure that the Trojan is launched automatically each time the system is booted, the Trojan adds a link to its executable file in the system registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"loadMect1" = "<path to Trojan executable file> "

Payload

The Trojan sends notification that the victim machine had been infected to the following email address:

The Trojan tracks keystrokes in windows titled "Lineage Windows Client". It harvest the user name and password to Lineage accounts.

Harvested data is saved to the following log file:

The log will periodically be sent to the remote malicious user by email.

The Trojan also terminates the following processes:

KVMONXP.KXP
KVXP.KXP
EGHOST.EXE
MAILMON.EXE
KAVPFW.EXE
IPARMOR.EXE
RavMon.exe
PasswordGuard.exe

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the Trojan process.
2. Delete the original Trojan file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following parameter from the system registry (see What is a system registry and how do I use it for details on how to edit the registry).

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "loadMect1" = "<path to Trojan executable file> "

4. Delete the following files:

   %Program Files%\rundll32.exe
   %System32%\ct1dll.dll

5. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).