Troj/PWSAgent-A is a password stealing Trojan for the Windows platform.
When run Troj/PWSAgent-A copies itself to the Windows folder as winos.exe and creates the following
registry entry in order to run automatically on user logon:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
windhost.exe
<Windows folder>\winos.exe
Troj/PWSAgent-A attempts to steal confidential information including the following:
INETCOMM Server Passwords
MS IE FTP Passwords
Outlook Account Manager Passwords
Email account details for HTTP, IMAP and POP3 accounts
Cached Internet Explorer FTP passwords
The Trojan periodically sends the logged information to a script at http://bnrdrv.com.