Troj/PWS-ACZ is a password-stealing Trojan for the Windows platform.
When first run, Troj/PWS-ACZ copies itself to <Windows>\9129837.exe and creates the following registry entry in order to be run automatically at startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ttool
<Windows>\9129837.exe
Troj/PWS-ACZ drops the file <Windows>\hide_evr2.sys and installs it as a service named hide_evr2 with the Display name "!!!!". This file is detected as Troj/NTRootK-AS and provides stealth functionality in order to hide processes, files and registry entries related to the Trojan.
Troj/PWS-ACZ steals passwords from the registry and local drives and submits them to an attacker using HTTP forms.
Sophos's anti-virus products include Behavioral Genotype™ Protection, which can proactively guard against new threats without requiring an update. Sophos customers have been protected against Troj/PWS-ACZ (detected as Mal/Behav-044) since version 4.10.