Spyware.TwoSeven

Updated: February 13, 2007 11:51:42 AM

Type: Spyware

Risk Impact: Low

File Names: example.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.TwoSeven is installed, it performs the following actions:

Copies itself as a file named example.exe.
Adds the value:

"ccApp"="path\example.exe"

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the spyware starts when Windows starts.
Monitors open windows with the following strings in their title bars:
- google
- alta vista
- lycos
Logs information typed into search fields and periodically sends the captured information to a predetermined Web site at the www.example.com domain.

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}