Russian Spyware Love Interest

Experts at SophosLabs have issued a public warning concerning the modus operandi of a Trojan discovered on July 27, 2006 that delivers what appears to be a slide show of a Russian girl looking for love. The promises of an amorous match are incentive enough for users to be convinced to run the program. In reality, Victoria Stasova's slide show drops the Troj/Keylog-HD Trojan horse onto Windows users' platforms. “When first run Troj/Keylog-HD displays a slideshow of 3 photos called "Victoria Stasova" with three different pictures. The Trojan silently copies itself to Windows foldersvchst.exe and creates the file Windowssvchst##.dll, where ## is a random two digit number,” describes Sophos security experts. The Troj/Keylog-HD is a keylogger program that starts recording keystrokes as soon as it is installed and sends all gathered data to a remote server controlled by the attacker. "The danger is that people might think they are just looking at pictures of a Russian beauty who is on the lookout for love. But behind the scenes, information and keypresses - including usernames and passwords - are being secretly stolen from the PCs by hackers," explained Graham Cluley, senior technology consultant for Sophos. "One of the ways in which malware like this could work is that computer users could find themselves being chatted up online by someone who they believe is a potential lovematch, and then be sent the slideshow as the virtual romance blossoms. Having found new love victims may rush to run the slideshow with their head in the clouds, and not realize their finances are being consigned to the gutter."