Home Malware Programs Trojans Generic PWS.y!bhd

Generic PWS.y!bhd

Posted: December 15, 2009

Generic PWS.y!bhd is a harmful Trojan that steals confidential data like online banking credentials and sends the information to malicious hackers. Generic PWS.y!bhd spreads by exploiting system vulnerabilities and spam email messages. Generic PWS.y!bhd can also provide the attacker with the details about your computer's hardware. Do not give Generic PWS.y!bhd the leeway to cause mayhem and spread, instead remove Generic PWS.y!bhd using a reliable anti-malware program.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %WinDir%\system32\lowsec\local.ds
    2 %WinDir%\system32\lowsec\user.ds
    3 %WinDir%\system32\lowsec\user.ds.lll
    4 %WinDir%\system32\sdra64.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Current Version\Explorer\{3446AF26-B8D7-199B-4CFC-6FD764CA5C9F}HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Current Version\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Current Version\Explorer\{4776C4DC-E894-7C06-2148-5D73CEF5F905}HKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\
Loading...