The following files will be present on an infected computer:
%System%\GTH60366.exe - copy of rundll32.exe
%System%\mmsfc1.dll - copy of mmsfc1.dll
%System%\sysGTH.dll - original comres.dll
Please let BitDefender disinfect your files.
Dana Stanut, virus researcher
This detection stands for the dll component responsible for monitoring user's activity of an online games password stealer.
When the dropper of this file is executed it will first make a copy of %System%\sfc_os.dll and name it %System%\mmsfc1.dll in order to bypass windows file protection when overwriting %System%\comres.dll with its malicious .dll file. The original comres.dll file will be saved under sysGTH.dll in the same folder. A copy of the malicious .dll file will be created also in %Windows%\fOntS\ folder. This component will be loaded in every running processes and will monitor user's activity as keystrokes and mouse gestures in order to steal sensitive information related to different online games or messenger accounts. The targeted programs are: QQ Login, Dungeon and Fighter, Tenio.
The component responsible with sending the gathered information to the malware author will be dropped in %Windows%\fOntS\ folder under GTH60366.ttf (detected as Trojan.PWS.OnlineGames.KBXJ).
The information (as username, password, server, money, goldCoin, equipment, level and others) will be sent to the following addresses: