McAfee Secure sites help keep you safe from identity theft, credit card fraud, spyware, spam, viruses and online scams
Business Home → McAfee Labs → Threat Intelligence

PWS-WoW!748e88f5

This page shows details and results of our analysis on the malware PWS-WoW!748e88f5

Threat Detail

Malware Type: Trojan

Malware Sub-type: Password Stealer

Discovery Date: 2007-12-13

Next Steps:

Overview

The trojan is a Password Stealers which attempts to steal login credentials for the World of Warcraft game and sends it to the trojan author.


Minimum DAT

5186 (2007-12-14)

Updated DAT

5186 (2007-12-14)

 Minimum Engine

5.1.00

File Length

11,6847 bytes

 Description Added

2007-12-13

Description Modified

2007-12-14

Malware Proliferation

Characteristics

Upon execution, the trojan drops the following files:

  •  %Windir%\Help\F3C74E3FA248.dll (PWS-WoW trojan)
  •  %Windir%\Help\F3C74E3FA248.exe (PWS-WoW trojan)

Then it modifies the following registry keys:

  • HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
     "(Default)" = SSUUDL
  • HKEY_CLASSES_ROOT\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
    "(Default)" = C:\WINDOWS\HELP\F3C74E3FA248.dll
    "ThreadingModel" = "Apartment"

The dll file is injected into running processes and attempts to steal the account information of the following onlinegame.

  • World of WarCraft

The gathered information is sent to the following site.

  • http://www.lin1e.com/[removed]

Symptoms

  • Existence of mentioned files and registry keys

Method of Infection

Trojans do not self-replicate. They spread manually, often under the premise that the executable is something beneficial.

They may also be received as a result of poor security practices, or un-patched machines and vulnerable systems. Distribution channels include IRC, peer-to-peer networks, email, newsgroups postings, etc.

Removal

All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

  • Insert the Windows XP CD into the CD-ROM drive and restart the computer.
  • When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  • Select the Windows installation that is compromised and provide the administrator password.
  • Issue 'fixmbr' command to restore the Master Boot Record
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.


On Windows Vista and 7:

  • Insert the Windows CD into the CD-ROM drive and restart the computer.
  • Click on "Repair Your Computer".
  • When the System Recovery Options dialog comes up, choose the Command Prompt.
  • Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

Variants

United States - English