PWSteal.Sacanph.A

PWSteal.Sacanph.A is a harmful and seditious Trojan which enters the system surreptitiously and sneakily performs all of its actions in the background, avoiding detection from the user or any installed security software. This Trojan is also known as TROJ_SPNR.07FC11, and was first released on July 10, 2011 and is classified as a severe threat. PWSteal.Sacanph.A is known to steal URL history and other sensitive information from the user’s applications. It also modifies Hosts files to prevent the user from accessing the Internet.

This Trojan can enter the system in a variety of ways. The most popular method of infiltration seems to be through bundled third party downloads. PWSteal.Sacanph.A can bundle itself with other seemingly legitimate software applications and security updates, and in this way avoid detection by security applications. It is also spread with suspect email attachments, and through instant messaging applications.

Because of its stealth infiltration, the user will be unaware of PWSteal.Sacanph.A’s presence. It does not have any tangible symptoms to identify its presence on the system, but the presence of the following file will indicate PWSteal.Sacanph.A’s presence on the system:

%AppData%\wintemp\csrss.exe

PWSteal.Sacanph.A will also add the following lines to your Hosts file in an effort to block you from accessing the Internet, while still allowing itself access to the Internet:

127.0.0.1 www.virustotal.com
127.0.0.1 http://virusscan.jotti.org/de

Some of the applications PWSteal.Sacanph.A will steal information from and relay to the information to its developers are:

COREFTP
Emule
FileZilla
ICQ
Miranda
SmartFTP
Trillian
Windows Live Messenger

The Trojan will connect to a remote server to relay all the stolen information to its developers, and to receive further instructions. The remote server it will connect to is as follows:

blaaaaaaaah.1x.de via port 80

Because this Trojan is so difficult to detect and remove, the user should make use of a proper security tool to get rid of PWSteal.Sacanph.A permanently. This will guarantee that all traces of PWSteal.Sacanph.A is deleted, and it will also protect the user from similar attacks in future.