Follow:

You have been re-routed to the PWS:Win32/Frethog write up because PWS%3aWin32%2fFrethog has been renamed to PWS:Win32/Frethog
 

PWS:Win32/Frethog


PWS:Win32/Frethog is a large family of password-stealing trojans that target confidential data, such as account information, from Massive Multiplayer Online Games (such as World of Warcraft, for example).


What to do now

Manual removal is not recommended for this threat. To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as the Microsoft Safety Scanner (http://go.microsoft.com/fwlink/?LinkId=212742). For more information, see http://www.microsoft.com/protect/computer/viruses/vista.mspx.

Threat behavior

PWS:Win32/Frethog is a large family of password-stealing trojans that target confidential data, such as account information, from Massive Multiplayer Online Games (such as World of Warcraft, for example).
Installation
Win32/Frethog is a large family and variants may install themselves using different file paths and file names.

When executed, Win32/Frethog drops a dll with a randomly generated file name and injects it into explorer.exe.
 
The dropper may then modify the following registry entries in order to execute itself at each Windows start:
HKEY_CURRENT_USER\SoftWare\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SoftWare\Microsoft\Windows\CurrentVersion\Run
 
Payload
Modifies System Security Settings 
The dropper attempts to circumvent security products by:
  • Attempting to prevent AVP Antivirus from displaying notifications regarding system changes by closing windows used by this product.
  • Attempting to terminate Ravmon.exe if it is found to be running on the affected system.
 
Steals Online Game Data
The dll, once injected, can obtain account information for one or more of the following Massively Multiplayer Online Games and affiliated products:
Rainbow Island
Cabal Online
A Chinese Odyssey
Hao Fang Battle Net
Lineage
Gamania
MapleStory
qqgame
Legend of Mir
World Of Warcraft 
 
The captured details are sent to a remote server.
 
Analysis by Matt McCormack

Symptoms

There are no obvious symptoms that indicate the presence of this trojan on an affected system.

Prevention


Alert level: Severe
First detected by definition: 1.45.287.0
Latest detected by definition: 1.183.108.0 and higher
First detected on: Oct 07, 2008
This entry was first published on: Mar 25, 2008
This entry was updated on: Apr 17, 2011

This threat is also detected as:
No known aliases