Trojan-Spy

Threat description

Details

Category: Malware
Type: Trojan-Spy
Platform: W32

Summary

This type of trojan secretly installs spy programs and/or keylogger programs.



Removal

Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for further assistance.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

Further actions

Various trojans may compromise system security by forwarding authentication information (logins and passwords, credit card numbers, etc.) to malicious parties. It is therefore very important to change all authentication details after disinfection, to protect against further misuse.

If your credit card number has been stolen or your bank account information has been compromised, it is recommended to contact your credit card company or bank for help.

Data theft may be legally classified as serious abuse in your jurisdiction; you may wish to contact the local cybercrime authorities for investigation. In this case, do not perform any disinfection actions on your computer before it is inspected by the authorities.



Technical Details

A Trojan-Spy is a type of trojan with a wide range of capabilities, including performing keylogging, monitoring processes on the computer and stealing data from files saved on the machine.

A Trojan-Spy will searches for specific files or data on an infected computer, which can be forwarded to, or retrieved by, the attacker. The type of information sought varies: some trojans try to locate 'key' files that contain authentication information for certain programs or services; others steal the serial numbers of software installed on an infected system.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

Learn More