Trojan-PSW.VBS.Half

Trojan-PSW.VBS.Half is a malicious program designed to search your system to find stored passwords, usernames, logins, PINs or even registration data and send to a hacker via email, a FTP or HTTP connection. You need to look at Trojans, malicious programs or worms as virtual criminals armed and dangerous to attack your PC and data. From the time a Trojan like Trojan-PSW.VBS.Half gains entry onto your PC, it is busy at work executing steps to:

1. Unload malicious programs or files it carried inside.
2. Modify the system's configuration so that its executable will run at every boot or a hacker can control web communications to send/receive data.
3. Add malicious program to approved programs listing to bypass firewall.
4. Edit files or programs threatening existence and mission, which might include actually deleting some programs.
5. Survey system and gather vital data to transmit it immediately or store on the infected system for later transmission to a remote server.

One of the security alerts or APBs (All Points Bulletin) indicated that Trojan-PSW.VBS.Half was a VBScript virus, and its file size was approximately 977 bytes. It further indicated Trojan-PSW.VBS.Half specifically targeted Win9x systems (Win 95, 98 and ME) having weak or no Internet security in place. Once inside, Trojan-PSW.VBS.Half was found to search directories on the victim's C:\ drive for files having a *.pwl extension, since these files are known to store user passwords. Trojan-PSW.VBS.Half may gather other data such as passwords, user names, PINs stored in the cache or system log data, encrypt it and send via email or using a HTTP or FTP connection.

When sending by email, Trojan-PSW.VBS.Half used an activeXobject 'MSMAPI.MAPISession' to transmit data to its boss (a hacker) under the address of onehalf***4@mail(dot)ru. The structure of the email may read as follows:

To: onehalf***4@mail(dot)ru
Subj: 'this is test for lame'
Body: 'hello my friend(c) onehalf***4:'.

An annoying but obvious sign is the circus act of a rogue security program. Rogue security programs use a series of false/positives and negatives to plant seeds of panic in the mind of its victims, in hopes they will blindly fall trap and hand a hacker their credit card information. Never entertain the tricks of some slick-looking interface that appears out of nowhere and runs an unauthorized quick scan. Security researchers who tested the architect of a basic rogue security program found the absence of the coding or script needed to initiate a scanning engine, so basically, what the victim sees is the simulation of a scan, created using JavaScript and imagery. Do not abandon your PC and allow some hacker to win! You should use a stealth anti-malware tool that is equipped with the necessary tools, such as an anti-rootkit, to not only remove Trojan-PSW.VBS.Half but to protect your system against future attacks!