Keylog-Melcarr

This is a trojan that installs itself on the victim's system for the purpose of logging any keys pressed and sending this log to a remote computer.  It possesses it's own SMTP engine and the logged data is sent via email to the attacker.  It may also post this data via HTTP to a remote PHP file.  By doing this, it allows the attacker to grab sensitive information, which may include usernames and passwords. 

Upon execution, the trojan copies itself to the %SysDir% folder under a randomly generated filename and modifies the registry to automatically load itself into memory at the next startup.

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "%Random name%" = %Random name%.exe

It creates a file with .DLL extension in the same folder.  This file is not really a DLL but a log file which stores the captured keystrokes made by the user.

The trojan will then send the DLL file to the attacker via email by using it's own SMTP engine.

This trojan will retrieve system information such as OS version, Cached Passwords, Disk Space, Processor Speed and further more will attempt to post this data via HTTP to a remote PHP file .

Trojans do not self-replicate. They are spread manually, often under the premise that the executable is something beneficial. Distribution channels include IRC, peer-to-peer networks, newsgroup postings, email, etc.

All Users:
Use specified engine and DAT files for detection and removal.

Additional Windows ME/XP removal considerations