Encyclopedia entry
Updated:
Jan 30, 2009
| Published:
May 26, 2008
Aliases
Not available
Alert Level
(?)
Severe
Antimalware protection details
Microsoft recommends that you download the
latest definitions
to get protected.
Summary
Win32/Frethog is a large family of password-stealing trojans that target confidential data, such as account information, from Massive Multiplayer Online Games (such as World of Warcraft, for example).
Symptoms
There are no obvious symptoms that indicate the presence of this trojan on an affected system.
Technical Information (Analysis)
Win32/Frethog is a large family of password-stealing trojans that target confidential data, such as account information, from Massive Multiplayer Online Games (such as World of Warcraft, for example). Some variants of Win32/Frethog are also able to spread via mapped drives by utilizing an autorun file.
Installation
Win32/Frethog is a large family and variants may install themselves using different file paths and file names.
When executed, Win32/Frethog drops a dll with a randomly generated file name and injects it into explorer.exe.
The dropper may then modify the following registry entries in order to execute itself at each Windows start:
HKEY_CURRENT_USER\SoftWare\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\Run
which packer is used. This driver is detected as either VirTool:WinNT/Vanti.A or VirTool:WinNT/Vanti.B. The above mentioned dlls may also be written to the %temp% directory when these packers are used.
Spreads Via...
Mapped Drives
Some variants of Win32/Frethog are also able to spread via mapped drives by utilizing an autorun file. TWin32/Frethog may enumerate drives from C- Z, copying itself to the root of the drive, and creating an 'autorun.inf' file. The autorun.inf is used to execute the worm whenever the drive is viewed with Windows Explorer.
Payload
Modifies System Security Settings
The dropper attempts to circumvent security products by:
-
Attempting to prevent AVP Antivirus from displaying notifications regarding system changes by closing windows used by this product.
-
Attempting to terminate Ravmon.exe if it is found to be running on the affected system.
Steals Online Game Data
The dll, once injected, can obtain account information for one or more of the following Massively Multiplayer Online Games and affiliated products:
Rainbow Island
Cabal Online
A Chinese Odyssey
Hao Fang Battle Net
Lineage
Gamania
MapleStory
qqgame
Legend of Mir
World Of Warcraft
The captured details are sent to a remote server.
Analysis by Matt McCormack
Prevention
Take the following steps to help prevent infection on your system:
-
Enable a firewall on your computer.
-
Get the latest computer updates.
-
Use up-to-date antivirus software.
-
Use caution with attachments and file transfers.
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
-
Click Start, and click Control Panel.
-
Click Network and Internet Connections. If you do not see Network and Internet Connections, click Switch to Category View.
-
Click Change Windows Firewall Settings.
-
Select On.
-
Click OK.
To turn on the Windows Firewall in Windows Vista
-
Click Start, and click Control Panel.
-
Click Security.
-
Click Turn Windows Firewall on or off.
-
Select On.
-
Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
-
Click Start, and click Control Panel.
-
Click System.
-
Click Automatic Updates.
-
Select a setting. Microsoft recommends selecting Automatic. If you do not choose Automatic, but you choose to be notified when updates are ready, a notification balloon appears when new downloads are available to install. Click the notification balloon to review and install the updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. To help protect you from infection, you should always run antivirus software that is updated with the latest signature files. Antivirus software is available from several sources. For more information,
see http://www.microsoft.com/protect/computer/viruses/vista.mspx.
Use caution with attachments and file transfers
Exercise caution with e-mail and attachments received from unknown sources, or received unexpectedly from known sources. Use extreme caution when accepting file transfers from known or unknown sources.
Recovery
