Registry Cleaner Geeks

March 19, 2009 8:53:51 AM

Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

In order to remove Remove Trojan.Skimer you need to Download the ‘No Adware’ remover software. Based on our testing this was the best peforming remover of Trojan.Skimer..

You will see the download link on their website, once installed it will perform a full system scan on your machine for free.

When executed, the Trojan copies itself as the following file:
%Windir%\lsass.exe

It then attempts to copy the file %Windir%\trl2 as one of the following files:

* %Windir%\greenstone.bmp:redstone.bmp (if the file system is in NTFS format)
* %Windir%\redstone.bmp (if the file system is in any other format)

It then attempts to copy the file %Windir%\kl as one of the following files:

* %Windir%\greenstone.bmp:bluestone.bmp (if the file system is in NTFS format)
* %Windir%\bluestone,bmp (if the file system is in any other format)

Note: The above files may be used to store information gathered from the compromised ATM.

It then injects itself into the following process:
explorer.exe

It then attempts to delete all files with the following names:
%Windir%\Prefetch\-[ASCII CHARACTERS].pf

The Trojan monitors the compromised computer for processes with the following names:

* mu.exe
* SpiService.exe

When found, the Trojan hooks API functions in the above processes so that it can alter the behavior of the ATM.

The Trojan may attempt to log transaction and PIN information to the following file:
%ProgramFiles%\Diebold\AMI\AMITRACE\AMITrace.txt

When logging account balance information, the Trojan converts account balances to US dollars using the following conversion rates:

* 26 Russian rubles : 1 US dollar
* 5 Ukrainian hryvnias : 1 US dollar

The Trojan may open a back door on the compromised ATM to allow an attacker to perform the following actions via the keypad:

* Display the logged information
* Print the logged information using the ATM printer
* Display the ATM software version
* Dispense cash
* Uninstall the Trojan horse
* Shut down the ATM

FREE SCAN:

MANUAL REMOVAL: Please click here for manual removal instructions.