Select local site

| Japanese | Simplified Chinese | Traditional Chinese (Hong Kong) | Traditional Chinese (Taiwan)

F-Secure Malware Information Pages: Trojan-PSW:W32/Lmir.BPG
[Summary] | [Detailed Description]

Name : Trojan-PSW:W32/Lmir.BPG
Alias:Trojan-PSW.Win32.Lmir.bpg
Type:Trojan-PSW
Category:Malware
Platform:W32
Radar

Summary
This is typical Trojan that logs keyboard strikes (key logger) and URLs visited by the user.
Back to the Top

Detailed Description
Upon execution, this malware drops a file on the root directory of the C:\ drive:

  • C:\xp2007.dat
    - Detected as Trojan.Win32.BHO.[variant]

This malware installs itself as a Browser Helper Object. It creates the following autostart registry keys:

  • HKLM\Software\{5FF908C9-578F-4A40-9643-E0CA07093990}
  • HKLM\Software\Classes\CLSID\{5FF908C9-578F-4A40-9643-E0CA07093990}
  • HKLM\Software\Classes\CLSID\{5FF908C9-578F-4A40-9643-E0CA07093990}\InprocServer32
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
    \{5FF908C9-578F-4A40-9643-E0CA07093990}

This malware logs keyboard strikes and mouse clicks of the user and then saves them in a file with a random name in the system's default temporary directory. It also logs the URLs (web site addresses) visited by the user and saves them in a separate log file, also with a random name.

Note: The temporary directory is normally C:\Documents and Settings\[account name]\Local Settings\Temp.
Back to the Top



F-Secure Corporation

Last Modified: December 19, 2007