TSPY_FAREIT.EWW
VirTool:Win32/CeeInject.gen!KK(Microsoft), RDN/Spybot.bfr!h(McAfee), Downloader.Ponik(Symantec), Trojan-PWS.Tepfer(Ikarus), Win32/PSW.Fareit.A trojan(Eset)
Windows 2000, Windows Server 2003, Windows XP (32-bit, 64-bit), Windows Vista (32-bit, 64-bit), Windows 7 (32-bit, 64-bit)
Tipo di minaccia informatica:
Spyware
Distruttivo?:
No
Crittografato?:
In the wild::
Sì
Panoramica e descrizione
Dettagli tecnici
Otras modificaciones del sistema
Agrega las siguientes entradas de registro como parte de la rutina de instalación:
HKEY_CLASSES_ROOT\Cad.Document
HKEY_CLASSES_ROOT\Cad.Document\DefaultIcon
HKEY_CLASSES_ROOT\Cad.Document\shell
HKEY_CLASSES_ROOT\Cad.Document\shell\
open
HKEY_CLASSES_ROOT\Cad.Document\shell\
open\command
HKEY_CLASSES_ROOT\Cad.Document\shell\
print
HKEY_CLASSES_ROOT\Cad.Document\shell\
print\command
HKEY_CLASSES_ROOT\Cad.Document\shell\
printto
HKEY_CLASSES_ROOT\Cad.Document\shell\
printto\command
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Cad
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Cad\Recent File List
HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\
Cad\Settings
Agrega las siguientes entradas de registro:
HKEY_CURRENT_USER\Software\WinRAR
HWID = "{random values}"
HKEY_CLASSES_ROOT\Cad.Document
(Default) = "Cad Document"
HKEY_CLASSES_ROOT\Cad.Document\shell\
open\command
(Default) = "{malware path and file name} "%1""
HKEY_CLASSES_ROOT\Cad.Document\shell\
print\command
(Default) = "{malware path and file name} /p "%1""
HKEY_CLASSES_ROOT\Cad.Document\shell\
printto\command
(Default) = "{malware path and file name} /pt "%1" "%2" "%3" "%4""
HKEY_CLASSES_ROOT\Cad.Document\DefaultIcon
(Default) = "{malware path and file name},0"