JS/PSYME Trojan functionality question

Factual Questions
1

My MiL’s comp has one of the JS/Psyme trojans on it.

It’s a password stealer. Apparently it has it’s own updater program :eek: and has active defenses against anti-malware programs.

I’m not that concerned about removing it as I’m just going to nuke the drive and start fresh. Why take chances with something that’s trickier than me?

I’m concerned about damage control.

What I would like to know but haven’t been able to discover is the method that it uses to acquire passwords and the like.

  1. Does it only get passwords that have been entered since it installed itself on her machine?

  2. Does it access browsers’ saved passwords?

  3. Does it access other saved passwords?

  4. Or what?

2

Does anyone know where I could find this information?

3

Bump for weekend, day-time users

4

Assume the worst, install a good spyware cleaner, my current favorite is superantispyware. Install it, install AVG anti virus, reboot in safe mode and run both.

Once its dead, reboot normally, scan again to make sure its gone. Then change all your passwords.

5

I appreciate you reply.

I’m not that concerned about removing the thing as I’m just going to nuke the drive and start fresh.

I’m concerned about damage control and risk assessment.