Home Malware Programs Trojans Troj/Spy-HN

Troj/Spy-HN

Posted: February 25, 2011

Serving double-duty as a Trojan and a keylogger, Troj/Spy-HN is a threat to your security as well as your privacy. Troj/Spy-HN has been indicated to spread through misleading emails, but may also infect computers by way of other Trojans or invasive website code. All information on a Troj/Spy-HN-infected system, especially keyboard input, should be considered at immediate risk of being leaked into the possession of criminals. Due to this and the malware's ability to add more malware to create a snowballing security problem, deleting Troj/Spy-HN fast is the only way you can keep your computer secure.

Don't Trust That 'Ebay' Email

While few malware invaders stick to just one potential infection route, Troj/Spy-HN is particularly known for being spread through emails. These emails will almost always fake the appearance of official Ebay.com communications, but will contain malicious links to download Troj/Spy-HN or other malware.

Since Troj/Spy-HN has been verified to create registry entries, it's highly likely that Troj/Spy-HN can start up along with Windows and then run quietly as a virtually invisible process. Even watching for unusual Task Manager processes isn't necessarily a dead giveaway, since Troj/Spy-HN may name itself after safe processes such as svchost.exe. Troj/Spy-HN's files may hide in your operating system folders, making them difficult to distinguish from normal Windows files.

Letting Troj/Spy-HN Inside Your PC Has Consequences

Primary side effects of a Troj/Spy-HN infection include:

  • Keylogging. This is the main verified function of Troj/Spy-HN which is used to spy on every keystroke of your keyboard. Security holes will be opened to allow the transmission of this information back to a remote attacker. This can be used to steal passwords, financial information, or even your identity. Troj/Spy-HN may specifically look for Ebay-related login information to snatch.
  • The likelihood of Troj/Spy-HN downloading and executing other malware on your machine is also very strong. You will not see the actual download or running process in most cases, but afterwards the malware may begin any number of varied and serious attacks. Be extremely suspicious of any new programs, files or processes that show up on a Troj/Spy-HN-infected system without your permission.
  • Troj/Spy-HN may corrupt system files, either by overwriting them with copies of itself or simply by damaging the files beyond usability for its own sake. In the worst cases, this can require a complete wipe and fresh installation of your operating system.

Other issues are also highly likely to arise, since Trojans like Troj/Spy-HN allow other malware to enter into a computer so easily. Disallow this from ever happening by practicing safe browsing behavior and deleting Troj/Spy-HN whenever it turns up in scan results.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %PROGRAM_FILES%\Troj/Spy-HN
    2 %System%\mspk.sys
    3 %System%\tabcteng.dll
    4 %Temp%\mst2.tmp
    5 %Temp%\tmp1.tmp
    6 c:\Documents and Settings\All Users\Start Menu\Troj/Spy-HN\
    7 c:\Documents and Settings\All Users\Troj/Spy-HN\

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Troj/Spy-HNHKEY..\..\..\..{RegistryKeys}HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mspkHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mspk\EnumHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mspk\SecurityHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSPKHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSPK\0000HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSPK\0000\ControlHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mspkHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mspk\EnumHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mspk\Security
Loading...