| Name |
SafeWin.exe |
Description
|
PWSteal.Focosenha is a Trojan horse program that attempts to steal user names, passwords, and other information from the infected computer.
Logs keystrokes and captures background images when the address bar in Internet Explorer contains predetermined URLs.
The keystrokes are saved in:
%Windir%\MSN\LogMedia.TXT
The captured images are saved in the directory:
%Windir%\MSN\DAT
Sends LogMedia.TXT and image files stored in %Windir%\MSN\DAT to a predetermined email address.
Manual removal:
Navigate to the key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
and delete the value: "Safe"="C:\Windows\MSN\SafeWin.exe"
Navigate to and delete the key: HKEY_CURRENT_USER\SafeMode |
|
Home
