TrojanSpy:Win32/Goldun.AF

Detected by Microsoft Defender Antivirus

Aliases: Trojan-Spy.Win32.Goldun.as (Kaspersky) W32/Goldun.AS (Norman) Troj/Goldspy-D (Sophos) Goldun.Fam (Sunbelt Software) Trojan.Goldun (Symantec) TROJ_GOLDUN.GEN (Trend Micro)

TrojanSpy:Win32.Goldun.AF is a Trojan that monitors Internet use and attempts to capture user names, passwords and financial information related to certain E-Gold Web site.

Threat behavior

TrojanSpy:Win32.Goldun.AF is a Trojan that monitors Internet use and attempts to capture user names, passwords and financial information related to certain E-Gold Web site. When TrojanSpy:Win32/Goldun.AF runs, it does the following:

Copies itself to %windir%/svchost.exe
Modifies the registry to load this copy of itself when Windows is started:

Adds value: Shell

With data: svchost.exe

In subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Attempts to retrieve the username/password associated with Internet and POP3 accounts
Attempts to capture sensitive information when impacted users access E-Gold web sites containing the following strings:

e-gold.com
e-gold.com/acct/balance.asp
e-gold.com/acct/login.html
e-gold.com/acct/accountinfo.asp

TrojanSpy:Win32.Goldun.AF attempts to send the captured information to a remote server.

Prevention

Take these steps to help prevent infection on your computer.

The following symptoms may be indicative of a TrojanSpy:Win32.Goldun.AF infection.

Presence of the following file:
%windir%/svchost.exe
Presence of the following registry modification:
Value: Shell
With data: svchost.exe
In subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

TrojanSpy:Win32/Goldun.AF

Summary

Technical information

Threat behavior

Prevention

Symptoms