Actions

• Win32/Alureon attacks Web browsers and alters the Web pages the user can visit. It can force the browser to display Web pages that it has stored on the local computer. Components also monitor traffic passing from the computer over the Internet and intercepts user names, passwords and other sensitive data, which it passes back to its controller. Another component hijacks browsers and redirects them to pages of the controller's choice. It can also modify the results of search engines, placing its own records in the list of results.
  
  

Security Avoidance

• The Alureon family includes processes to hide the programs of the suite in standard areas of a computer's file storage. It creates temp files in the system temp directory and generates fake DLL files that look like printer drivers. Once the masked files implementing the actions of the Trojan have been developed, the original files are deleted, making it difficult for experts to recommend to others which files to delete. The programs can also prevent the computer from downloading security software and block access to anti-virus websites.
  
  

Delivery Method

• Alureon is a Trojan. It gets on a computer by encouraging the user to download and install it. No one would knowingly download malicious software, so it tempts the user by using a fake identity. Streaming video downloads temporarily onto the computer in a process called “buffering” and Alureon uses this method to get onto a computer as it masquerades as a sensational video posted on blogs. The Trojan also gets downloaded onto computers as a fake password crack utility distributed in file sharing systems. The user of a file sharing site may download a movie or song, only to be told that he needs an access password to open the file. Searching for the password, the user encounters a crack program or a file listing the passwords for free. This is the Alureon Trojan.
  
  

Spread

• Win32/Alureon is particularly active in the United States. Canada, the United Kingdom, Australia and Western Europe are also affected to a lesser extent. The creators of viruses and Trojans tend to target users of countries that speak their language. The trick software that gets the software downloaded in the first place has to be meaningful to the victim, and the data retrieved from the user's computer has to be meaningful to the hijacker in order to be useful.