high
Summary
Summary
Action- More Information
| Affected operating systems | Windows |
|---|---|
| Characteristics |
|
| Protection available since | 24 August 2005 08:23:18 (GMT) |
| Detected by | All Sophos products |
Free virus scan
- Free virus, spyware, and adware scan
- Test your existing anti-virus protection
- Find threats your anti-virus missed
Action
- Summary
- Action
- More Information
Please follow the instructions for removing worms.
Change any data that may have become compromised.
Windows NT/2000/XP/2003
In Windows NT/2000/XP/2003 you will also need to edit the following registry entry. The removal of this entry is optional in Windows 95/98/Me. Please read the warning about editing the registry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE entry:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SpyEx
<Program Files>\Common Files\Winllogo.exe
and delete it if it exists.
Close the registry editor.
More Information
W32/PrsKey-A is a password stealing and keylogging worm aimed at the Priston Tale game and Yahoo! web email accounts.
The worm silently monitors keyboard activity waiting for the user to either play Priston Tale or access Yahoo! email accounts and begins keylogging information once access is found.
W32/PrsKey-A includes functionality to:
- access the internet and communicate with a remote server via HTTP
- send the logged information to a remote location
W32/PrsKey-A is a password stealing and keylogging worm aimed at the Priston Tale game and Yahoo! web email accounts.
The worm silently monitors keyboard activity waiting for the user to either play Priston Tale or access Yahoo! email accounts and begins keylogging information once access is found.
When run W32/PrsKey-A attempts to copy itself to the location:
<Program Files>\Common Files\Winllogo.exe
<Program Files>\Common Files\Win.exe
W32/PrsKey-A creates the registry entry to run Winllogo.exe on startup:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SpyEx
<Program Files>\Common Files\Winllogo.exe
Once installed, W32/PrsKey-A will begin keylogging information and store the logged information to the file C:\text.txt. This file is harmless and can be deleted.
W32/PrsKey-A includes functionality to:
- access the internet and communicate with a remote server via HTTP
- send the logged information to a remote location
W32/PrsKey-A spreads by attempting to copy itself to network shared folders at the following location:
\Documents and Settings\All Users\Start Menu\Programs\Startup\winllogo.exe
|
