Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


Mitglieder


Aliases:


Mitglieder
TrojanProxy.Win32.Mitglieder.c

Malware
Trojan
W32

Summary

Mitglieder is a trojan that functions as an e-mail relay. The trojan kills tasks of several programs and reports certain info to its creators. Bagle worm has the functionality to download and activate this trojan from a website.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

When run, the trojan installs itself to system. It copies its file as SYSTEM.EXE to Windows System directory and creates the following entry in the System Registry:

[HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "ssgrate.exe" = "%winsysdir%\system.exe"
 

where %winsysdir% is the name of Windows System directory.

The trojan also creates another entry in the Registry where it stores its internal variables.

Then the trojan starts a thread that accesses 15 different websites and opens a PHP page there with certain parameters. This way the trojan reports its ID, proxy port and IP of infected computers to its authors.

After that trojan starts a thread that terminates processes with the following names:

ATUPDATER.EXE
 AVWUPD32.EXE
 AVPUPD.EXE
 LUALL.EXE
 DRWEBUPW.EXE
 ICSSUPPNT.EXE
 ICSUPP95.EXE
 UPDATE.EXE
 NUPGRADE.EXE
 ATUPDATER.EXE
 AUPDATE.EXE
 AUTODOWN.EXE
 AUTOTRACE.EXE
 AUTOUPDATE.EXE
 AVXQUAR.EXE
 CFIAUDIT.EXE
 MCUPDATE.EXE
 NUPGRADE.EXE
 

The trojan has 3 links in its body that point to a data stealing trojan that is located on 3 different websites. This trojan is detected as 'Trojan.PSW.Ldpinch.as'. The infected files have been recently removed from those website already.

The trojan has a mail relay that functions on the certain port (in the sample we got the port number is 39999).



Detection

Detection for this trojan was was published on January 15th, 2004 in the following update:

Detection Type: PC
Database: 2004-01-15_01



Technical Details: Alexey Podrezov, January 19th, 2004



Scan and clean your PC




F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Disinfect your PC




F-Secure Anti-Virus will disinfect your PC and remove all harmful files