Spyware.InternetSpy

The installation path of Spyware.InternetSpy is configurable. The default is %Program Files%\Internet Spy.

When Spyware.InternetSpy is executed, it performs the following actions:

1. Creates the registry keys:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\KMiNT21\InternetSpy
   HKEY_CLASSES_ROOT\CLSID\{85DDD882-701E-401B-8A7D-D51227048214}
   HKEY_CLASSES_ROOT\TypeLib\{CF9CAB33-968A-4227-AFEB-A7877C496D8B}
   HKEY_CLASSES_ROOT\Iewatcher.ViewSource
   HKEY_CLASSES_ROOT\Iewatcher.ViewSource.1
   HKEY_CLASSES_ROOT\TypeLib\{CF9CAB33-968A-4227-AFEB-A7877C496D8B}
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CF9CAB33-968A-4227-AFEB-A7877C496D8B}
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{85DDD882-701E-401B-8A7D-D51227048214}HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Iewatcher.ViewSource
   HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Iewatcher.ViewSource.1
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{85DDD882-701E-401B-8A7D-D51227048214}
   
   
2. Records the URLs that you visit in the file, iewatch.txt. This file is located in the Spyware.InternetSpy installation folder.

Summary