Troj/Goldun-O

Please follow the instructions for removing Trojans.

Change any data that may have become compromised.

Troj/Goldun-O is a password-stealing Trojan.

Troj/Goldun-O monitors outgoing HTTP requests for traffic going to specific internet banking sites. On encountering such a request the Trojan will attempt to extract account details from the returned page and submit these details to the Trojan's autho using an HTTP form submission. Troj/Goldun-O is a password-stealing Trojan.

Troj/Goldun-O monitors outgoing HTTP requests for traffic going to specific internet banking sites. On encountering such a request the Trojan will attempt to extract account details from the returned page and submit these details to the Trojan's autho using an HTTP form submission.

The Trojan creates the file "csrss.dll" (also detected by Sophos as Troj/Goldun-O) in the Windows system folder and installs this as an Internet Explorer plugin by creating the following registry entries:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Browser Helper Objects\{92617934-9abc-def0-0fed-fad48c654321}

HKCR\CLSID\{92617934-9abc-def0-0fed-fad48c654321}\InprocServer32\
""
<Windows system folder>\csrss.dll

The Trojan also creates a number of registry entries for its own use under

HKCR\CLSID\{92617934-9abc-def0-0fed-fad48c654321}