|
|
Detect and remove hidden rootkits using
UnHackMe
RegRun Security Suite = 24 system utilities for protecting your computer. Try now! |
 CTin10.exe - Useless
Is a Trojan horse that imitates the online interfaces of certain Brazilian banks to try to steal account information. It is a minor variant of PWSteal.Bancos.D. Also known as PWSteal.Bancos, PWSteal.Bancos.B, PWSteal.Bancos.C, PWSteal.Bancos.D Copies itself as itself to the %System%\Ctin10.exe. Adds the value: "CTin10"="%System%\CTin10.exe" to the registry keys: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices so that the Trojan runs when you start Windows. If the file C:\BancoBrasil\officeIE\officeIE.CAB exists, the Trojan will move it to C:\officeIE.CAB. Monitors the active Internet Explorer windows, waiting for you to open a Web page that matches the characteristics of certain banking sites. Such as: https:/ /www2.bancobrasil.com.br/aapf/aai/principal https:/ /bankline.itau.com.br/GRIPNET/Montamenu.exe https:/ /internetcaixa.caixa.gov.br/NASApp/SIIBC/Login_ok.processa https:/ /wwwss.bradesco.com.br/scripts/ib2k1.dll/LOGINCHK#top When such a site is opened, the Trojan displays one of several login screens, which are selected according to the URL. The information entered on these screens may then be emailed to another computer. Manual removal: Navigate to the keys: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices and delete the value: "CTin10"="%System%\CTin10.exe"
Recommended software: RegRun Security Suite - removal and protection. http://www.regrun.com RegRun Reanimator - free removal tool. greatis.com/reanimator
What is hidden in MSDN? Why software developers prefer Win32.FreeTechSecrets.com? All Unix Manuals in Alphabetical Order C# controls for .NET in 3 simple steps. Constantly updated. Last update: May 12 2008
Interesting information about Vista programs... Need consultation? Would you like to add your opinion?
|
|
