New keylogger specializes in stealing passwords from IE

New keylogger specializes in stealing passwords from IE Picture 1

Security company Sunbelt Software has warned about the abundance of a new Keylloger program that collects all information from web surfers, especially from Internet Explorer.

Sunbelt Software's security experts have captured a file which contains a huge number of user names, access codes, phone numbers, credit card numbers, bank account names and lots of information. Other 'dangerous' individuals.

All of the above information is collected by a new keylogger program, which is small in size, works quite secretly and skillfully.

This keyboard crawler program is named Srv.SSA-KeyLogger, which specializes in stealing data from users' surfing sessions, as well as information from programs compatible with HTML forms.Srv.SSA-KeyLogger specifically 'likes' online financial transaction information from eBay, PayPal and banks.

Eric Sites, Sunbelt's vice president of research and development, said Srv.SSA-KeyLogger is related to Dumador / Nibu trojan family.He refused to passively sit down to record the username and password that the user typed in to record it, but he also knew how to exploit data from Internet Explorer data areas, especially from Protected. Internet Explorer storage.

Protected Storage is usually a block of specialized registry keys to remember usernames and passwords that users type.When Internet Explorer 's AutoComplete feature is enabled (usually by default), the browser will record this information and save it in Protected Storage.Although this information is encrypted but Srv.SSA-KeyLogger can be easily unlocked to steal information.

Srv.SSA-KeyLogger can also easily record everything stored in Windows clipboard, able to turn off Windows firewall and some other firewall applications.Srv.SSA-KeyLogger works exactly like an Internet Explorer command string, so all firewall applications are almost impossible to identify.

Sunbelt recommends that users should immediately turn off Internet Explorer AutoComplete to limit the operation of Srv.SSA-KeyLogger.Users should go to Options of Internet Explorer, then go to Internet Options -> Content -> AutoComplete -> remove the check mark from the 'User names and passwords on forms' section and click OK.

Other browsers such as Firefox, Mozilla, Opera, Netscape do not use the same features as Protected Storage, so they are more secure than this malicious keylloger.

Users canclick hereto download the tool against Srv.SSA-KeyLogger designed by Sunbelt.

HOANG HAI (According to TechWeb News)