Follow:

 

HackTool:Win32/PasswordFox


HackTool:Win32/PasswordFox is a free tool that is used to display the user names and passwords stored in Firefox.



What to do now

To detect and remove this threat and other malicious software that may be installed on your computer, run a full-system scan with an appropriate, up-to-date, security solution. The following Microsoft products detect and remove this threat:

Threat behavior

HackTool:Win32/PasswordFox is a free tool that is used to display the user names and passwords stored in Firefox.

It drops a configuration file named <file name>.cfg in the folder it runs from. For example, "PasswordFox.exe" drops "PasswordFox.cfg".

For each entry in Firefox, the following information is displayed:

  • Record index
  • Website
  • User name
  • Password
  • User name field
  • Password field

The tool may look similar to the following:

 

Analysis by Jingli Li


Symptoms

System Changes

The following system changes may indicate the presence of HackTool:Win32/PasswordFox

  • The display of the following user interface:

Prevention


Alert level: Medium
First detected by definition: 1.141.843.0
Latest detected by definition: 1.191.785.0 and higher
First detected on: Nov 30, 2012
This entry was first published on: May 25, 2011
This entry was updated on: Dec 12, 2012

This threat is also detected as:
  • not-a-virus:PSWTool.Win32.NetPass.ajt (Kaspersky)
  • Tool.PassView.359 (Dr.Web)
  • Win32/PSWTool.PassFox.A (ESET)
  • HTool-PWSFFox (McAfee)