Virus Encyclopedia
Welcome to the Virus Encyclopedia of Panda Security.
Recovery | |
Threat Level Damage Distribution |
At a glance
 |
| Common name: | Recovery |
| Technical name: | Hacktool/Recovery |
| Threat level: | Medium |
| Alias: | not-a-virus:RiskWare.PSWTool.PWLView.c |
| Type: | Hacking Tool |
| Effects: | It obtains files with a PWL extension from the affected computer, which contain sensitive information such as Internet access passwords. It only affects computers with Windows ME/98/95 operating systems. |
| Affected platforms:
| Windows ME/98/95 |
| First detected on: | May 13, 2005 |
| Detection updated on: | March 6, 2006 |
| Statistics | No |
Proactive protection: | Yes, using TruPrevent Technologies
|
Brief Description | |
Recovery is a hacking tool that obtains files with a PWL extension from the affected computer. These files contain sensitive information like dial-up and network passwords and are usually used only by Microsoft programs. Additionally, Recovery only affects computers with Windows ME/98/95 operating systems. |
Visible Symptoms | |
Recovery is easy to recognize once it has affected the computer, as it displays the following message box when it is run: 
|
Tech details
Effects |
Recovery obtains files with a PWL extension from the affected computer. These files contain sensitive information like dial-up and network passwords and are usually used only by Microsoft programs. Additionally, Recovery only affects computers with Windows ME/98/95 operating systems. |
Infection strategy
Recovery creates the following entry in the Windows Registry:
- HKEY_CURRENT_USER\ Software\ Microsoft\ InternetExplorer\ Main
StartPage = www.progenic.com
By creating this entry, Recovery modifies the home page of Internet Explorer.
Further Details
Recovery is written in the programming language Visual C++ v4.20. This hacking tool is 26,112 bytes in size.
Additionally, the option menu of Recovery is the following:
