Troj/PWS-ACP

Aliases	PWS-JB trojan Win32/PSW.QQShou
Category	Viruses and Spyware
Type	Trojan
What to do	If you've received an alert for a virus or spyware, then follow the instructions for removing the threat.
Prevalence	low high

Summary


Affected operating systems	Windows
Characteristics	Installs itself in the registry
Included in our products from	May 2007 (4.17)
Protection available since	17 October 2006 12:56:19 (GMT)
Last updated	11 April 2007 23:03:28 (GMT)
Detected by	All Sophos products

Troj/PWS-ACP is a password stealing Trojan for the Windows platform.

Troj/PWS-ACP includes functionality to access the internet and communicate with a remote server via HTTP.

Troj/PWS-ACP also attempts to terminate a number of AV and security related processes.

When first run Troj/PWS-ACP copies itself to:

<Temp>\116501456
<System>\ravseteyns.exe

Troj/PWS-ACP creates the file <System>\winsylbtew.dll. This is in fact a text file, and may safely be deleted.

The following registry entry is created to run ravseteyns.exe on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Rapdatybs
<System>\ravseteyns.exe

Get reports about the latest virus and spyware threats delivered to your computer