Home Malware Programs Worms W32.Spyrat

W32.Spyrat

Posted: January 20, 2011

W32.Spyrat is an information stealing computer worm which cause major problems for the targeted victim. W32.Spyrat scans your PC for passwords, particularly for online banking, and will steal these passwords and send them to malicious hackers. W32.Spyrat will attempt to intercept and transmit your Instant Messaging sign-in information, other cached Windows passwords, and email account passwords. W32.Spyrat is extremely dangerous and should be removed immediately. Symptoms of this cyber attack include system depreciation, stange files appearing on the desktop as well as personal files being stolen, and eventually the system will crash leaving you without access to your PC.

Experts recommend using a reliable anti malware program to make your PC is free from all threats. Manual removal of W32.Spyrat is possible but complex, and if the user is not adept at the technical side of PC engineering then experts strongle suggest using an automatic malware remover.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %System%\install\server.exe
    2 %System%\wbem\Performance\WmiApRpl_new.ini
    3 %Temp%\Windows 7 Validation.exe
    4 %Temp%\Windows Update.dat
    5 %Temp%\Windows Update.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RunHKEY_CURRENT_USER\Software\NoxiousAgentHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{X22A05IH-EVVT-MRI6-7B8E-5J057P0N0G1C}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ExplorerHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
Loading...