Updated: January 3, 2008 5:20:40 PM
Type: Potentially Unwanted App
Name: Password Inspector
Publisher: SellMoSoft
Risk Impact: Low
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP
When the program is executed, it creates the following files:
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\PasswordInspector.lnk
- %UserProfile%\My Documents\My Inspector Passwords\default.pips
- %UserProfile%\My Documents\My Inspector Passwords\desktop.ini
- C:\Documents and Settings\All Users\Desktop\PasswordInspector.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\PasswordInspector\PasswordInspector on the Web.url
- C:\Documents and Settings\All Users\Start Menu\Programs\PasswordInspector\PasswordInspector Online Help.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\PasswordInspector\PasswordInspector.lnk
- C:\Documents and Settings\All Users\Start Menu\Programs\PasswordInspector\Uninstall PasswordInspector.lnk
- %ProgramFiles%\PasswordInspector (Paid)\BtfToWd.dll
- %ProgramFiles%\PasswordInspector (Paid)\btwapi.dll
- %ProgramFiles%\PasswordInspector (Paid)\CReader.dll
- %ProgramFiles%\PasswordInspector (Paid)\license.txt
- %ProgramFiles%\PasswordInspector (Paid)\passinsp.chm
- %ProgramFiles%\PasswordInspector (Paid)\passinsp.exe
- %ProgramFiles%\PasswordInspector (Paid)\PcidCrc.dll
- %ProgramFiles%\PasswordInspector (Paid)\pibho.dll
- %ProgramFiles%\PasswordInspector (Paid)\picapbtn.dll
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\chrome\piffbho.jar
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\chrome.manifest
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\components\.autoreg
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\components\piffbho.dll
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\components\piffbho.xpt
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\components\spIPromptService.js
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\components\spIPromptService.xpt
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\install.js
- %ProgramFiles%\PasswordInspector (Paid)\piffbho\install.rdf
- %ProgramFiles%\PasswordInspector (Paid)\piffbho.xpi
- %ProgramFiles%\PasswordInspector (Paid)\pikeeper.dll
- %ProgramFiles%\PasswordInspector (Paid)\pipcact.dll
- %ProgramFiles%\PasswordInspector (Paid)\piprot.dll
- %ProgramFiles%\PasswordInspector (Paid)\piprotdb.dll
- %ProgramFiles%\PasswordInspector (Paid)\piprotui.dll
- %ProgramFiles%\PasswordInspector (Paid)\piprtrun.exe
- %ProgramFiles%\PasswordInspector (Paid)\pires.dll
- %ProgramFiles%\PasswordInspector (Paid)\readme.txt
- %ProgramFiles%\PasswordInspector (Paid)\Sellmsft.dll
- %ProgramFiles%\PasswordInspector (Paid)\unins000.dat
- %ProgramFiles%\PasswordInspector (Paid)\unins000.exe
- %ProgramFiles%\PasswordInspector (Paid)\unzip32.dll
It also creates the following folder:
%UserProfile%\Application Data\Sellmosoft\PasswordInspector
Next, the program creates the following registry entry so that it executes whenever Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"PasswordInspector" = "C:\Program Files\PasswordInspector (Paid)\passinsp.exe"
It then creates the following registry subkeys:
- HKEY_CURRENT_USER\.pips
- HKEY_CURRENT_USER\PasswordInspector Database
- HKEY_CURRENT_USER\Software\Classes\.pips
- HKEY_CURRENT_USER\Software\Classes\PasswordInspector Database
- HKEY_CURRENT_USER\Software\PasswordInspector
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PasswordInspectorPaid_is1
- HKEY_LOCAL_MACHINE\SOFTWARE\PasswordInspector
The application stores passwords for other applications.
It may also download other security risks on to the computer.