Hacktool.Pwdump Hack Tool

[Brad]

Behavior
Hacktool.Pwdump is a hack tool that is used to grab Windows password hashes from a remote Windows computer.

Symptoms
A file is detected as Hacktool.Pwdump

Transmission
This hack tool must be manually installed.

technical details
File names: PwDump3.exe; pwservice.exe

Once executed, Hacktool.Pwdump performs the following actions:

   1. Connects to a remote computer.

   2. Downloads a file named pwdservice.exe.

   3. Registers pwdservice.exe as a remote service.

   4. Adds the value:

      "000" = "pwdservice.exe"

      to the registry subkey:

      HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer

   5. Sends back extracted password hashes.

REMOVAL INSTRUCTIONS

See: http://securityresponse.symantec.com/avcenter/venc/data/hacktool.pwdump.html