MonitoringTool:Win32/Powerspy.B

MonitoringTool:Win32/Powerspy.B is a malicious Trojan which spies on its victims’ computer activity and relays the stolen information to its developers. It was first released on 15 January, 2010 and is classified as a severe threat by many security companies. This Trojan enters the system surreptitiously and will remain hidden from the user throughout its lifespan on the system. MonitoringTool:Win32/Powerspy.B also operates under various aliases, some of which are:

Program.PowerSpy.1
SPR/PowerSpy.H.7
MonitoringTool:Win32/Powerspy.F
Spyware-PowerSpy
virus:Monitor.Win32.PowerSpy.e
Gen:Trojan.Heur.bm0@XiJQ1Sci
Trojan.Win32.Generic.pak!cobra
MAS.Trojan.VB.01541

The threat will give its developers complete remote access to the infected system, which will allow them to use the PC as part of DoS attacks and various other nefarious operations. MonitoringTool:Win32/Powerspy.B’s power is limited on the system depending on the user privileges it is run under. Its normal activities include data theft system modification or deletion of files, keystroke logging and using the infected system as part of mass spamming or botnet attacks.

MonitoringTool:Win32/Powerspy.B is installed through software bundling as part of software applications available from file sharing networks, email attachments, instant messaging networks or websites containing executable content such as ActiveX control.

This Trojan in specific was designed to infect Windows 32-bit executable programs, and operates effectively in different Win32-environments. There are no distinguishable symptoms associated with this threat, and the only notifications the user will receive as to the presence of MonitoringTool:Win32/Powerspy.B on the system will come from notifications generated by installed security software. In order to limit the damage MonitoringTool:Win32/Powerspy.B will cause to the PC, and to destroy MonitoringTool:Win32/Powerspy.B effectively make use of a powerful security tool which will not only erase MonitoringTool:Win32/Powerspy.B but also protect the PC against similar attacks in future.