WinPasswords

WinPasswords is a password recovery tool that may be used to gain unauthorized access to a computer and to a user s data. It is harmful if installed without the knowledge of the user.

General information:

Malware Name: WinPasswords
Malware Type: Password Recovery Tool
Company Name: Computer Security Labs
Company URL: http://winpasswords.com/
Threat Level: Low Risk
Operating System: WIN XP
Installation Type: Installed through EXE
Operation: Time of After Installation

Company Description:

Computer Security Labs provides you the software Win Passwords that is used to recover Passwords. This program helps in recovering passwords for dial-up accounts, Internet Explorer protected sites and Outlook Express mailboxes.

Spyware Description:

WinPasswords is a password recovery tool that may be used to gain unauthorized access to a computer and to a user s data. It is harmful if installed without the knowledge of the user.

Characteristics/Symptoms:

    -> It is harmful if installed without the knowledge of the user. -> It may be used to gain unauthorized access to a computer and to a user s data.

Additional information might be found here:

google Search at Google for WinPasswords
bing Search at Bing for WinPasswords
yahoo Search at Yahoo for WinPasswords

Processes Running:

WinPass.exe

File information Created after Installation:

File Location Size (Bytes) Type
C:\Program Files\WinPasswords\WinPass.exe 333136 Application
C:\Program Files\WinPasswords\uninstall.ini 1570 Configuration Settings
C:\Program Files\WinPasswords\winpass.cnt 255 CNT File

Folder information Created after Installation:

Folder Location
C:\Documents and Settings\[USER]\Start Menu\Programs\WinPassword

Registry information Created after Installation:

Main Registry Key Sub Registry Key Key Value Name
HKEY_CURRENT_USER \Software\WinPass 9651A2CC
HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinPasswords
HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\WinPasswords Changed