Email-Worm.Win32.Lover.a: new atypical keylogger

30th June 2008

Kaspersky Labs found the original keylogger that can effectively organize hidden presence in the system. The found worm is distributed by e-mail in the file to_my_love.scr. Its run leads to appearing a kind of a screensaver “Geometrical Waltz” that is designed to divert the user`s attention. At the infected machine the keylogger records key-pressings when working with browsers and IM-mail clients (Opera, Firefox, Internet Explorer, The Bat!, MSN Messenger, ICQ, QIP and others).
To conceal its presence, the worm splits an executive code into parts.
The type of “disguising” was found by Kaspersky Lab atypical for this type of malware. It is interesting enough, that lexics, found in the code allowed the specialists to assume that the author of the worm is Russian-speaking.

Handy Backup 6.1: updating line of data protection