An Analysis of SpyEye Detection and Removal Tools

Abstract

On 2011-02-15, several Norwegian banks observed malware attacks on their online banking interfaces. Following the observation, customers were advised to download and run SpyEye malware detection and removal tools to find out if their machines were affected and to remove the malware in case an infection was confirmed. We can confirm that the detection tool detects presence of SpyEye malware on a personal computer. We can also confirm that the removal tools we tested do remove SpyEye malware from a personal computer. We are concerned that removal is not complete in all cases and we are concerned that the detection and removal tools are susceptible to manipulations of their user interface by future variants of SpyEye malware.