Trojan.Spyeyes

Trojan.Spyeyes is an especially dangerous piece of malware. This is one of those rare instances when a threat really is dangerous enough to do real harm to the user of an infected computer. Trojan.Spyeyes is designed to steal money from the users of infected computers and to control infected computers remotely, and Trojan.Spyeyes is designed to do it directly, by stealing personal information. What makes Trojan.Spyeyes an especially serious threat is that Trojan.Spyeyes can do all of its deeds, and you will not know about it – unless you have an anti-virus application that detects the infection.

What is Trojan.Spyeyes?

Trojan.Spyeyes – more commonly referred to as Spyeyes – is a sophisticated program. Trojan.Spyeyes is written in a way that allows Trojan.Spyeyes to hide itself from the users of the computers that Trojan.Spyeyes infects, preventing Trojan.Spyeyes' Registry entries, files, and activities from being located or detected. For example, Spyeyes injects its code into your computer's running processes, so that Trojan.Spyeyes can run within them invisibly. Spyeyes also takes advantage of file compression and basic memory functions, by compressing Trojan.Spyeyes' files in a way that it can only be unlocked by a specific password – and that the password is hidden inside the machine's memory at the assembly level (within the stack), so that it can't be accessed later on its own. The person who created Spyeyes knew what he/she was doing, which is why Spyeyes does not cause any symptoms. So, you will not know that Spyeyes has infected your computer unless you use security program that knows to look for the Trojan, and detects the changes that the malware has made. Otherwise, Spyeyes can hang out on your PC indefinitely, stealing data and giving a remote user the ability to control your computer as part of a botnet.

Like the Zeus Trojan kit before it, Trojan.Spyeyes is a money-making venture for Trojan.Spyeyes' creator and for users of the malware. The Spyeyes software is sold (in the underground) for about $500, and for that the buyer receives what is essentially a Trojan builder. Spyeyes has a wide variety of configurable options, including which web browsers to attack, which countries to attack, which information to steal, and even what to call the main executable file that is called by the Windows Registry when Windows starts. (By default, it is called cleansweep.exe, but each individual Spyeyes user may name it whatever he or she wishes for each Spyeyes Trojan that is built. Therefore, the publicly-listed "aliases" for cleansweep.exe listed in some locations online are misleading, because they only refer to individual Spyeyes builds, by individual people, and not to any larger scheme or pattern.)

Although Spyeyes was originally only capable of attacking Internet Explorer and Firefox, Trojan.Spyeyes now targets Chrome and Opera as well, meaning that information accessed via those browsers can be stolen. Because Spyeyes captures keystrokes and saves them instantaneously, even information entered into a secure form or on a secure site can be stolen. In order to corner the market on malware that targets banking information, Spyeyes has also developed the idea to kill or remove any instances of the Zeus Trojan that Trojan.Spyeyes finds on infected PCs, as well as the ability to use the infected computer as part of a botnet, to launch denial-of-service attacks on Abuse.ch, a site that tracks and reports on Spyeyes botnets and other similar Trojan threats.

Where Does Trojan.Spyeyes Came From?

Spyeyes was first released in Russia in the fall of 2009, and infections began to be detected by major anti-virus companies in February 2010. Since then, Trojan.Spyeyes has become increasingly widespread. With the addition of the ability to attack more web browsers, as well as to attack Zeus and Abuse.ch, Trojan.Spyeyes became significantly more dangerous in January and February 2011. Since then, Spyeyes infections have become more common and problematic, with some financial institutions being hit hard by abuse of stolen banking information.

Keep in mind that Trojan.Spyeyes is, as Trojan.Spyeyes' name implies, a Trojan. Trojan.Spyeyes can't replicate itself, and Trojan.Spyeyes can't spread on its own. Trojan.Spyeyes is installed when you are tricked into installing Trojan.Spyeyes, one way or another. Most commonly, Trojan.Spyeyes is installed when you download a file from a pirating site or peer-to-peer service, or when you open or run a file that is attached to a spam email. In other words, it is easy to avoid getting Trojan.Spyeyes – far easier than it is to know that your computer has Trojan.Spyeyes, or to remove Trojan.Spyeyes.

SpyHunter Detects & Remove Trojan.Spyeyes