Signature Detail

SPYWARE: Troj_spywad_x

This signature detects the runtime behavior of Downloader.AFH, also called TROJ_SPYWAD.x. TROJ_SPYWAD.x is a hijacker application. Upon execution on the infected machine, it adds an icon in the system tray, which cannot be removed by the victim. It creates a spysheriff folder and attempts to install it; it also attempts to download and execute a possibly malicious file.

Extended Description

None

References

• URL: http://gr.trendmicro-europe.com/smb/vinfo/encyclopedia.php?LYstr=VMAINDATA&VName=TROJ_SPYWAD.x
• URL: http://www.sophos.com/virusinfo/analyses/trojspywadi.html
• URL: http://vil.nai.com/vil/content/v_136151.htm