Spyware For Firefox

There's a new spyware threat called Formspy that affects the alternative web browser. Generally, Firefox has been spyware free, but as it has become more popular, the malware makers are setting their sites on it.

What Formspy does is to pose as a legitimate extension called NumberedLinks 0.9. Once installed, it will log and steal any information you enter on web sites, such as passwords, credit card numbers, and anything else you enter. It appears that Formspy is downloaded by another trojan, Downloader AXM.

The following file are added by Formspy:

Windows\System32\138762763.exe

There are a few more added to the Firefox folder, but they are modified versions of the legitimate files that are found there.

McAfee detects and removes this threat, but I don't know what else does at the moment.