Soccer Trojan from South Africa


Home Grown Malware?

Satelite Image of South Africa

Image from Wikipedia

It looks like Trojan tvwjfm.exe (with several other names too Рlist of known names and further information) could have originated from South Africa. At least the first reported  infections came from this locale.

This makes a change to the norm where the largest percentage of new malware hails from the Asian Sub-Continent, although a tie-in to this region cannot be excluded.

This Trojan has not had a big impact; outbreaks so far seem to be limited, possibly deliberately targeting specific users. However, the few reported instances should not be taken to imply this Trojan is not dangerous – it is.

The file is unusually large for a Trojan, containing a package of other files. If run, it behaves like an application installer. Even if the install is cancelled, the Trojan installs other malware unknown to the PC user.

Soccer Trojan

Soccer TrojanI have decided to unofficially name this Trojan (as yet it has no official name) the Soccer Trojan. It presents itself with an icon of a soccer ball superimposed over a PC display, similar to the image on the left, which is clearly an attempt to encourage followers of this ball game to run the file.

Hopefully the Soccer Trojan will remain obscure, and not spread. Our vigilance is required at this early stage to interdict the malware before it gets the opportunity to ‘go viral’ and escape into the wild.

Advertisements

About Mike

Web Developer and Techno-geek Saltwater fishing nut Blogger

Posted on November 28, 2011, in Malware, Virus, Trojans, Security Threats and tagged , , , , , , , . Bookmark the permalink. 2 Comments.

  1. thanks Mike! On a completely unrelated topic, any idea how I can get WINZIP and ZIPCOurier off my computer? I downloaded them because I needed to compress a file and now they insist on compressing every file I email – some of them end up corrupted and some the users can’t open because they don’t have the right software (and I am not going to recommend they download this!). I have tried deleting it from he program files, but it says I don.t have permission.

    • I have e-mailed you for some additional info:

      A few questions:

      Did you download the installer from http://www.winzip.com (Corel) or one of the other download sites (e.g. torrent downloads)? – If I know this I can look at that installer package

      Your Operating System – XP, Vista, 7 (and version)?
      Probably a silly question, but have you tried uninstalling in ‘Safe Mode’? – no other applications open…
      Are you using webmail (gmail or similar) or Office Outlook…. Or is it affecting both? (provides some clues to where the app files are located and the registry entries.)
      How long ago was the app installed – is it possible to do a system restore to before the app was installed? (Often the easiest thing to do)

      Can you look for registry entries with the following (part) strings?

      Winzip Winzip courier or winzip_courier etc – or a search in registry for ‘winzip’, ‘zip’, ‘courier’

      e.g.:

      HKEY_CURRENT_USER\Software\WinZip Courier

      HKEY_LOCAL_MACHINE\Software\WinZip Courier

      Can you open the registry folder – HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\

      and take a screen capture of all entries – mail to me… (If lucky there may be a clear reference to the app) – these are apps that get loaded on win start-up – if we can identify the zipcourier entry simply deleting the entry should stop it running on start-up.

      After backing up the registry!!!!!

      NOTE: The ‘do not have permission’ thing is concerning if the uninstall fails from a full administrator account or in Safe Mode…. That is often an indication of another problem – malware related.

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: