1. Symantec/
  2. Security Response/
  3. Spyware.TwoSeven

Spyware.TwoSeven

Updated:
February 13, 2007 11:51:42 AM
Type:
Spyware
Risk Impact:
Low
File Names:
example.exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.TwoSeven is installed, it performs the following actions:
  1. Copies itself as a file named example.exe.
  2. Adds the value:

    "ccApp"="path\example.exe"

    to the registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the spyware starts when Windows starts.

  3. Monitors open windows with the following strings in their title bars:
    • google
    • alta vista
    • lycos

  4. Logs information typed into search fields and periodically sends the captured information to a predetermined Web site at the www.example.com domain.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube