Sophos

Troj/Nice-A

Aliases
  • Trojan-Spy.Win32.VB.cs
  • Generic
  • PWS.e
  • trojan
  • TROJ_KEYLOGGER.A
Category
Type
What to do
Prevalence low high

Summary

 
Affected operating systems Windows
Characteristics
  • Installs itself in the registry
Included in our products from May 2005 (3.93)
Protection available since 16 March 2005 18:11:37 (GMT)
Detected by All Sophos products

Action

More Information

Troj/Nice-A is a configurable keylogger Trojan for the Windows platform that runs in the background and logs the key inputs.

Troj/Nice-A emails the stolen information to the predefined address.

Once executed Troj/Nice-A copies itself to the Windows folder, and in order to be able to run automatically when Windows starts up sets the registry entry with the path to the copy:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Microsoft PCHealth32
<path to Trojan>

Also Troj/Nice-A sets the registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
DisableTaskMgr
dword:00000001

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\
disableregistrytools
dword:00000001

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer