Home Malware Programs Trojans Trojan-Spy.Banker.PPAW

Trojan-Spy.Banker.PPAW

Posted: March 4, 2011

PC threats like Trojan-Spy.Banker.PPAW give Brazilians especial reason to be paranoid about their bank accounts, since Trojan-Spy.Banker.PPAW specifically looks for and steals information from Brazilian online banking services. Even non-Brazilians will not want Trojan-Spy.Banker.PPAW on their computer, though, because Trojan-Spy.Banker.PPAW's spyware programming is assisted by heavy Trojan functions that can drop multiple types of other Trojans onto any computer. For Brazilians, this spying Trojan is a particular threat, but all computer users should be eager to delete Trojan-Spy.Banker.PPAW if there's a hint of Trojan-Spy.Banker.PPAW's existence on their PC.

You Don't Have to Live in Brazil to Get Trojan-Spy.Banker.PPAW

Don't relax even if you're not living in Brazil or doing any business with Brazilian websites; Trojan-Spy.Banker.PPAW may still be able to clamber onto your computer anyway. Although Trojan-Spy.Banker.PPAW infection rates for Brazil are naturally higher than they are for most other areas there have also been reports of this Trojan in European countries.

Indications so far point to infected and small pirate applications being the main way Trojan-Spy.Banker.PPAW gets from system to system. These applications can be seeded throughout P2P networks or uploaded on websites that offer illegal freeware.

Trojan-Spy.Banker.PPAW may or may not be packed or reduced in size by an external program; this creates an inconsistent file size between different packages of the Trojan that can make Trojan-Spy.Banker.PPAW hard to identify. Compression techniques may also let Trojan-Spy.Banker.PPAW shimmy under your anti-virus protection without triggering the relevant alarm systems.

Trojan-Spy.Banker.PPAW is a Brazilian Threat to Brazilian Bankers

Attacks associated with Trojan-Spy.Banker.PPAW can have terrible results for both Brazilians and non-Brazilians alike:

  • Trojan-Spy.Banker.PPAW will grab online banking information related to Brazilian accounts. Passwords and other sensitive information are immediately placed at incredibly risk on any machine infected with Trojan-Spy.Banker.PPAW.
  • Trojan-Spy.Banker.PPAW is known to download a variety of different Trojans such as Backdoor.Bifrose which may themselves download other malware! Besides the rapidly ballooning malware problem, your computer may also be accessed by remote attackers for varied hostile purposes
  • .

  • Many Trojans like Trojan-Spy.Banker.PPAW will commonly disable security programs and settings, partially to enable malware downloading and partially to prevent their own removal.

This state of affairs obviously can't persist forever; either you delete Trojan-Spy.Banker.PPAW, or you may find yourself left with a worthless and malware-riddle computer. Depending on the anti-malware programs you use to fight the Trojan-Spy.Banker.PPAW threat, the Trojan may also be detected by the names Gen.Trojan or Trojan-Downloader.Win32.Genome.abgr.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %AppData%\msnliveq.exe
    2 %AppData%\msnlives.exe
    3 %AppData%\qghumeaylnlfdxfircvs85.exe
    4 %PROGRAM_FILES%\Trojan-Spy.Banker.PPAW
    5 %Temp%\google_cache2.tmp
    6 c:\Documents and Settings\All Users\Start Menu\Trojan-Spy.Banker.PPAW\
    7 c:\Documents and Settings\All Users\Trojan-Spy.Banker.PPAW\

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\Software\Trojan-Spy.Banker.PPAW[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\..{RunKeys}[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
Loading...