Trojan.Rimecud

As always there are extremely dangerous threats to your PC security and privacy to be extra cautious of, and Trojan.Rimecud is definitely one of those. This subversive Trojan is tricky to detect on any PC as it conducts all its behavior in the background, not alerting the user to any of activities.

The Trojan is spread via certain peer to peer applications, such as MSN Messenger, and through systems with vulnerable VNC servers, and VNC servers which don’t need passwords. Removable drives have also been known to spread Trojan.Rimecud of late. This Trojan also contains backdoor functionality which gives access to third parties to the infected PC.

The entire purpose behind Trojan.Rimecud is to unlawfully gain information stored in IE and Mozilla Firefox browsers. It not only obtains confidential data from the user’s browser, but it will send it unidentified persons the user never intended to give access to.

Once Trojan.Rimecud firmly roots itself in the system it will attempt to contact a remote host at update2.helohmar.com, using the port 80. It does this in order to receive configuration settings and other data from the unidentified host, as well as to report the new infection to the author. It will also use this connection to download and execute arbitrary files, which may include additional malware or updates of the malware already present on the PC. The author of the Trojan will also be able to instruct Trojan.Rimecud, and will upload the stolen data from the afflicted PC.

As mentioned earlier it will be difficult to detect and ultimately successfully remove Trojan.Rimecud without some help. Trojan.Rimecud will create a copy of itself in the system folder under the following name:

Msvmiode.exe

Finding this file on the PC would confirm that you are indeed infected with this seditious Trojan.

This certainly paints a dire picture of this Trojan. If you suspect foul play on your PC employ the removal power of a genuine security application which will not only permanently destroy Trojan.Rimecud from your PC but also offer valuable protection against future similar attacks and threats.