TSPY_FAREIT.EWW
VirTool:Win32/CeeInject.gen!KK(Microsoft), RDN/Spybot.bfr!h(McAfee), Downloader.Ponik(Symantec), Trojan-PWS.Tepfer(Ikarus), Win32/PSW.Fareit.A trojan(Eset)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Malware-Typ:
Spyware
Zerstrerisch?:
Nein
Verschlsselt?:
In the wild::
Ja
Überblick
Technische Details
Andere Systemänderungen
Fügt die folgenden Registrierungsschlüssel hinzu:
HKEY_CLASSES_ROOT\Cad.Document
HKEY_CLASSES_ROOT\Cad.Document\DefaultIcon
HKEY_CLASSES_ROOT\Cad.Document\shell
HKEY_CLASSES_ROOT\Cad.Document\shell\
open
HKEY_CLASSES_ROOT\Cad.Document\shell\
open\command
HKEY_CLASSES_ROOT\Cad.Document\shell\
print
HKEY_CLASSES_ROOT\Cad.Document\shell\
print\command
HKEY_CLASSES_ROOT\Cad.Document\shell\
printto
HKEY_CLASSES_ROOT\Cad.Document\shell\
printto\command
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Cad
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Cad\Recent File List
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Cad\Settings
Fügt die folgenden Registrierungseinträge hinzu:
HKEY_CURRENT_USER\Software\WinRAR
HWID = "{random values}"
HKEY_CLASSES_ROOT\Cad.Document
(Default) = "Cad Document"
HKEY_CLASSES_ROOT\Cad.Document\shell\
open\command
(Default) = "{malware path and file name} "%1""
HKEY_CLASSES_ROOT\Cad.Document\shell\
print\command
(Default) = "{malware path and file name} /p "%1""
HKEY_CLASSES_ROOT\Cad.Document\shell\
printto\command
(Default) = "{malware path and file name} /pt "%1" "%2" "%3" "%4""
HKEY_CLASSES_ROOT\Cad.Document\DefaultIcon
(Default) = "{malware path and file name},0"