|
Startupapps.com recommends you:
Detect and remove hidden rootkits using
UnHackMe
Free fully functional 30-days trial.
RegRun Security Suite = 24 system utilities for protecting your computer.
Try now!
I would like to say that RegRun has helped me on more than 1 occasion
when it comes to spyware/adware by letting me know automatically that a piece of it
got added to Windows startup. There is so much spyware/addware out
there today it's hard to imagine being without RegRun. I like many
other features too including the daily registry backups and file
protection.
Chris Wagers
|
|
CTin10.exe - Useless
ctin10.exe
PWSteal.Bancos.E.
Is a Trojan horse that imitates the online interfaces of certain Brazilian banks to try to steal account information.
It is a minor variant of PWSteal.Bancos.D.
Also known as PWSteal.Bancos, PWSteal.Bancos.B, PWSteal.Bancos.C, PWSteal.Bancos.D
Copies itself as itself to the %System%\Ctin10.exe.
Adds the value:
"CTin10"="%System%\CTin10.exe"
to the registry keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
so that the Trojan runs when you start Windows.
If the file C:\BancoBrasil\officeIE\officeIE.CAB exists, the Trojan will move it to C:\officeIE.CAB.
Monitors the active Internet Explorer windows, waiting for you to open a Web page that matches the characteristics of certain banking sites.
Such as:
https:/ /www2.bancobrasil.com.br/aapf/aai/principal
https:/ /bankline.itau.com.br/GRIPNET/Montamenu.exe
https:/ /internetcaixa.caixa.gov.br/NASApp/SIIBC/Login_ok.processa
https:/ /wwwss.bradesco.com.br/scripts/ib2k1.dll/LOGINCHK#top
When such a site is opened, the Trojan displays one of several login screens, which are selected according to the URL.
The information entered on these screens may then be emailed to another computer.
Manual removal:
Navigate to the keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
and delete the value:
"CTin10"="%System%\CTin10.exe"
Recommended software:
UnHackMe - easy removal Rootkits/Adware/Spyware.
http://www.unhackme.com
RegRun Security Suite - removal and protection.
http://www.regrun.com
RegRun Reanimator - free removal tool.
greatis.com/reanimator
RegRun - User's Choice
Vista Programs - full info...
What is hidden in MSDN? .NET Secrets Revealed
Why software developers prefer Win32.FreeTechSecrets.com?
All Unix Manuals in Alphabetical Order
C# controls for .NET in 3 simple steps.
Constantly updated. Last update:
May 12 2008
Interesting information about Vista programs...
Need consultation?
Would you like to add your opinion?
|
|
- Quick Links
-
What's new?
RSS Feed
Add to AppDatabase
Ask Experts
Join forum
Links
- Articles
-
Virus or not? SPTD####.sys
What is mc21.tmp, mc22.tmp, mc23.tmp?
- Select
-
Necessary
Useless
At your option
Dangerous
|