|
|
Tro.fullbizzone.svchost Trojan Information
| Name: |
Tro.fullbizzone.svchost |
| Category: |
Trojan |
| Advice: |
Remove |
| Risk: |
Severe Risk
Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. |
| Description:
|
Tro.fullbizzone.svchost is a program used by attackers to steal sensitive information from the infected machine.
Tro.fullbizzone.svchost installs itself as a BHO (Browser Helper Object) on the infected machine.
Tro.fullbizzone.svchost steals information from form logs. This information can include user name and passwords, credit cards numbers and other sensitive information. Tro.fullbizzone.svchost steals passwords from E-mail programs as well as the Windows protected storage area. Tro.fullbizzone.svchost will steal any E-mail address that can be found on the infected system.
Tro.fullbizzone.svchost also collects information about the infected such as the operating system installed, service packs and programs.
Tro.fullbizzone.svchost creates 5 files in the %Windows% directory (f1.rlg, f2.rlg, f3.rlg, f4.rlg, f5.rlg) where this information is stored. This stolen information is then transferred via FTP to a pre-defined address.
Tro.fullbizzone.svchost may also attempt to disable alerts from firewall programs in order to circumvent detection.
|
| Signatures:
|
process: svchost.exe: MD5 Hash: f78beabac2c7e663b34.. |
| Type: |
Trojan - A Trojan software is any software on a user's computer that the user is not aware or intentionally installed. Most Trojan software is designed to perform some sort of actions that could jeopardize the user's security or privacy. |
Top Trojan Visited Pages:
Tro.Downloader.loadadv - 410 visits
Enable Regedit - 192 visits
Java.ClassLoader.Dummy.d - 184 visits
Trojan.BankerSpy - 178 visits
RBot.steam - 86 visits
Startup.NameShifter.Xgtray - 77 visits
Tro.Bagle.SP - 59 visits
LRPatch Trojan - 57 visits
Trojan.BHO.NameShifter.EZ - 55 visits
Tro.YourStartingPage - 54 visits
Random Trojan Pages:
Trojan.Startup.NameShifter.GI
TrojanSpy:Win32/Tofger.AT
Trojan.Startup.NameShifter.GZ
Startup.NameShifter.MC
JS.Fav.e
Startup.NameShifter.KT
Anspy
Killall.C.Batch - Alias: Bat/iw trojan
Overwriting Sectors Trojan - Alias: 2272 Trojan
Clix0r.exe
|
|
