high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Included in our products from | February 2007 (4.14) |
| Protection available since | 27 November 2006 23:19:49 (GMT) |
| Last updated | 20 December 2006 00:22:35 (GMT) |
| Detected by | All Sophos products |
Action
- Summary
- Action
- More Information
Please follow the instructions for removing Trojans.
More Information
Troj/PWS-ACZ is a password-stealing Trojan for the Windows platform.
When first run, Troj/PWS-ACZ copies itself to <Windows>\9129837.exe and creates the following registry entry in order to be run automatically at startup:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
ttool
<Windows>\9129837.exe
Troj/PWS-ACZ drops the file <Windows>\hide_evr2.sys and installs it as a service named hide_evr2 with the Display name "!!!!". This file is detected as Troj/NTRootK-AS and provides stealth functionality in order to hide processes, files and registry entries related to the Trojan.
Troj/PWS-ACZ steals passwords from the registry and local drives and submits them to an attacker using HTTP forms.
Sophos's anti-virus products include Behavioral Genotype™ Protection, which can proactively guard against new threats without requiring an update. Sophos customers have been protected against Troj/PWS-ACZ (detected as Mal/Behav-044) since version 4.10.
|
