Hacktool.SpySharp Password Attacker

[Brad]

Behavior
Hacktool.SpySharp is a program that allows a remote attacker to steal passwords from a compromised computer.

Symptoms
Files detected as Hacktool.SpySharp. The executable file can reside anywhere on the computer.

Transmission
Hacktool.SpySharp can be installed by visiting a Web site on the softwareofchanges.com domain and downloading and executing the executable.

technical details
File names: %SYSTEM%\spysharp.dll

The following registry subkey is created:

HKEY_LOCAL_MACHINE%\SOFTWARE\Classes\CLSID\{64298A21-77D3-11d4-A2F5-000022D2404C}

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/hacktool.spysharp.html