Trojan-Spy:W32/FinSpy.A

Threat description

Details

CATEGORYMalware
TYPETrojan-Spy
PLATFORMW32, Android, SymbOS, iOS

Summary

Trojan-Spy:W32/FinSpy.A is a component of a commercial surveillance product that monitors user activity. Variants of FinSpy also exist on other platforms.



Removal

Automatic action - PC

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

Automatic action - mobile

F-Secure's Mobile Security product blocks installation of this program with default settings.

Note

If you have been infected by FinSpy, Privacy International would like to hear from you. For more information, please see:

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

Technical Details

Trojan-Spy:W32/FinSpy is a component of the surveillance product FinFisher, a commercial trojan manufactured and sold by a UK-based company called Gamma International. This trojan has reportedly been used against citizens in Egypt, Bahrain and Turkmenistan, as well as other locations.

Once FinSpy has infected a computer, it can be used to remotely monitor the system, including taking screen shots, recording keyboard strokes and intercepting Skype communications. It is also reportedly able to track mobile devices and monitor activities, including messaging and calls, made on the affected devices.

Description Created: 2012-08-03 10:40:00.0

Description Last Modified: 2012-09-04 13:40:00.0

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Scan & clean your PC

F-Secure Online Scanner will scan and clean your PC in just a few minutes for free

More Info