Trojan-GameThief.Win32.Lmir.a

Technical Details

This Trojan is designed to steal confidential data. It is a Windows PE EXE file. The size of infected files may vary from 147KB to 171KB. It is packed using AsPack. It is written in Delphi.

Installation

Once launched, the Trojan copies itself to the Windows root directory (%WinDir%) under one of the following names (depending on the modification):

internet.exe
winsys.exe

It adds a link to its executable file in the system registry:

[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
"winsys" = "%WinDir%\winsys.exe"

or:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Internet" = "%WinDir%\internet.exe"

depending on the modification. This ensures that the Trojan will be launched each time the system is booted.

Payload

This Trojan is designed to steal user passwords to Legend of Mir 2, an online game. The Trojan searches for windows headed "legend of mir2" and harvests the account name and password entered by the user in these windows.

The Trojan sends harvested information to one of the following addresses:

***yahuu@163.net
dong****@163.com 
friend***@peoplemail.com.cn

The Trojan does this by using the following SMTP servers:

smtp.163.com
smtp.peoplemail.com.cn

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the "explorer.exe" process.
2. Delete the following parameters from the system registry (see What is a system registry and how do I use it for details on how to edit the registry).

   [HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
   "winsys" = "%WinDir%\winsys.exe"

   or:

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
   "Internet" = "%WinDir%\internet.exe"

   Delete the following files:

   %WinDir%\internet.exe 
   %WinDir%\winsys.exe 

3. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

Technical details

File size of 2543472 bytes. The file was packed using a special compression utility. Compression can be used for a number of reasons, including for legitimate programs. However, virus writers frequently use it to bypass antivirus protection and to make it difficult for virus analysts to analyze compressed programs Packed ASPack.

Malicious activity

Uses the masks shown below to search for files on the victim machine:

• *.*