When Spyware.TwoSeven is installed, it performs the following actions:
- Copies itself as a file named example.exe.
- Adds the value:
to the registry key:
so that the spyware starts when Windows starts.
- Monitors open windows with the following strings in their title bars:
- Logs information typed into search fields and periodically sends the captured information to a predetermined Web site at the www.example.com domain.