Retefe Checker

Detected by ESET as JS/Retefe, the Retefe trojan horse targets banks and their users. It harvests online login data of its victims, which can then be used to perform unauthorized banking transactions. Given te the fact that the list of targets increases, ESET has released a dedicated detection and removal tool for the Retefe malware.

Symptoms of the Retefe infection

The Retefe trojan is spread via email, residing in an attachment of a pretend invoice or order. Once the email is opened, a Powershell script is executed, which results in modifications to your browser's proxy settings (Internet Explorer, Mozilla Firefox, and Google Chrome are vulnerable to this).
Additionally, a new root certificate is deployed, which might pass as authentic, as it is issued by a well-known authority, Comodo. These are some of the most visible symptoms of the infection. Please note that different variants might also deploy other applications without authorization, such as Proxifier or Tor.

Consequences of the Retefe infection

Retefe's configuration file contains a list of online banking webpages that are automatically modified by the trojan when accessed. As such, the malware manages to capture the logon credentials of the user, which can then be used for fraudulent operations.
Please note that not all the sites that Retefe targets are of banks. For instance, it also modifies the pages of some online mail services and social networks, such as Facebook.

Get rid of the Retefe trojan with ease

Now that you know what to look for when talking about the Retefe trojan, you should focus on the solution to the problem. ESET's Retefe Checker is a dedicated removal tool that searches for traces of the Retefe trojan and attempts to remove infected files.
No installation is required, and Retefe Checker launches in the command console, running a scan to find infected files, and cleaning files marked as dangerous.

A removal tool for the Retefe trojan

Cleaning a trojan-infected PC is not an easy task, but ESET, as other security companies out there, tries to keep up with the ever-growing complexity and diversity of cybercrimes. Before running the application, you are advised to change your credentials and check for fraudulent transaction, then erase the certificate mentioned above.