Home Malware Programs Trojans Infostealer.lanaur

Infostealer.lanaur

Posted: February 10, 2011

Infostealer.lanaur is spyware that infects computers secretly and then steals crucial information for criminal use. Infostealer.lanaur targets all major Windows operating systems both elderly and recent by spying on your web browsing and email behavior. Infostealer.lanaur can be removed either manually or automatically, but can cause additional infections that may cause this to be more challenging. Although Infostealer.lanaur refrains from directly damaging your computer, you should delete Infostealer.lanaur in short order, since it utterly violates any system privacy and is highly likely to create holes in your security.

How Infostealer.lanaur Gets in a Computer

As a Trojan, Infostealer.lanaur will try to infect computers with users being none the wiser. This may occur through the download of infected .exe files, through harmful advertising scripts, or when another infection downloads and runs Infostealer.lanaur automatically. Infostealer.lanaur may be bundled with a real or fake codec or other form of software update. Security software that isn't kept updated may not see newer infections like Infostealer.lanaur. Relying on a single brand of a scanner to catch all invaders is riskier than having multiple backup scanners.

Infostealer.lanaur is a Threat to Your Browser

Infostealer.lanaur uses a standard malware tactic of changing your registry to insure that it starts up along with Windows every time, whether there are obvious external signs of this or not. This necessitates a trip through regedit.exe to sort through your registry and delete malicious entries. Deleting only Infostealer.lanaur's files and not the registry entries may result in system errors of varying severity and makes it more difficult to spot other malware fiddling in the future.

When running, Infostealer.lanaur operates as a Browser Help Object, though it's far from helpful. Although some malicious BHOs will show the user that they're active, spyware like Infostealer.lanaur may operate without being seen. Detecting an active version of Infostealer.lanaur will require watching for common malware symptoms such as mysteriously appearing files and processes, unusual browser and system behavior, and the disabling of important services like Windows Task Manager. Since BHOs require .dll files to function, be particularly watchful for new files of that type - Infostealer.lanaur will always come with at least one.

Infostealer.lanaur's Spies, Steals and it Gets Worse

Infostealer.lanaur's main function is to serve as spyware. As such, Infostealer.lanaur will keep track of all sensitive information that passes through your browser, and may also record keystrokes from your keyboard. This puts all passwords, accounts, online banking information and personal profile data at risk. Information gathered by Infostealer.lanaur will be emailed to a criminal's mailbox, with the final result potentially being as serious as losing all your savings in your bank account or full-blown identity theft.

The Infostealer.lanaur spyware has also been reported to download other kinds of malware. The results of this can be variable but are inevitably damaging to the system and the information stored on it. Ideally you'll be able to catch Infostealer.lanaur in the act and delete it before it calls over too many other types of infectious software.

If you're not that fortunate, being able to recognize common malware traits may save your computer from the consequences of hosting Infostealer.lanaur. Browser hijacks, high-intensity error messages that encourage you to install software, pop-ups, and interruption of various programs are just some of the many symptoms this extra malware can cause. Some malware may be similar to Infostealer.lanaur and show few symptoms at all, but that isn't an indication of the prospective damage to your machine being minor! In most cases, you'll be able to notice infections through unwanted Task Manager processes and files on your hard drives. Safe Mode and a thorough scan with several kinds of authentic anti-malware scanning products will often be all you need to destroy Infostealer.lanaur and everything that came with it.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %CurrentFolder%\md_[NUMBER].dll

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Alx\Config\"INSTALADO" = "S"HKEY_CURRENT_USER\Software\Alx\Config\"VRS" = "[VERSION NUMBER]"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\"Play_Background_Sounds" = "no"HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\"*.bradesco.com.br" = "[BINARY VALUE]"HKEY..\..\..\..{RegistryKeys}FILE NAME].dll"HKEY_CLASSES_ROOT\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\"Default" = "Alx2000"HKEY_CLASSES_ROOT\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\InprocServer32\"Default" = “%CurrentFolder%\[TROJANHKEY_CLASSES_ROOT\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\InprocServer32\"ThreadingModel" = "Apartment"HKEY_CLASSES_ROOT\CLSID\{0DBB4430-2805-4FF2-AC7D-43985BC678B8}\ProgID\"Default" = "[TROJAN FILE NAME].MsShutt_HKEY_CLASSES_ROOT\[TROJAN FILE NAME].MsShutt_[VERSION NUMBER]\Clsid\"Default" = "{0DBB4430-2805-4FF2-AC7D-43985BC678B8}"HKEY_CLASSES_ROOT\[TROJAN FILE NAME].MsShutt_[VERSION NUMBER]\”Default” = “Alx2000?[VERSION NUMBER]"
Loading...