Sophos

Troj/Goldun-AF

Aliases
  • Trojan-Dropper.Win32.Agent.acp
  • PWS-Banker.at
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Protection available since 27 November 2005 16:19:08 (GMT)
Last updated 27 November 2005 21:42:04 (GMT)
Detected by All Sophos products
  • Free virus, spyware, and adware scan
  • Test your existing anti-virus protection
  • Find threats your anti-virus missed

Action

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

More Information

Troj/Goldun-AF is a password stealing Trojan for the Windows platform.

Troj/Goldun-AF targets customers of the E-Gold online banking service.

When Troj/Goldun-AF is installed the following files are created:

<Temp>\WithLove.jpg
<System>\msdos.dll

The file msdos.dll is registered as a COM object and Browser Helper Object (BHO) for Microsoft Internet Explorer, creating registry entries under:

HKCR\CLSID\{7EBC6A1F-CBDD-4263-3814-463926792311}
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7EBC6A1F-CBDD-4263-3814-463926792311}

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer