Spyware.AceSpy

Printer Friendly Page

Updated: February 13, 2007 11:37:59 AM

Type: Spyware

Version: 2.02.0018

Publisher: Retina-X Studios

Risk Impact: High

File Names: Acespy32.exe,Systune.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

Spyware.AceSpy can do the following:

Log keystrokes.
Log the names of open programs.
Take periodic screenshots.
Set a list of key words to monitor.
Send alerts by email whenever a program or Web page that contains a key word is opened.
Automatically close programs or Web pages that contain key words.
Send the logged information to a specified email address or FTP server.
Allow the person who installed it to access the interface by pressing Ctrl+TRL+Alt+Shift+M, and then entering a password. The default password is 123456.

When Spyware.AceSpy runs, it performs the following actions:

Creates these folders:
- %System%\Acespy
- %System%\Acespy\Manual. This folder contains the help/readme manual.
  
  Note: %System% is a variable. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Creates the following files:
- %System%\acespy\__acelog.ndx: A log file that is not malicious and will therefore not be detected.
- %System%\acespy\ANSMTP.dll: A valid ActiveX mail server.
- %System%\acespy\Asycfilt.dll: A valid ActiveX component.
- %System%\acespy\Comcat.dll: A valid Windows dll.
- %System%\acespy\Comdlg32.ocx: A valid ActiveX component.
- %System%\acespy\ijl11.dll: A valid JPEG conversion dll.
- %System%\acespy\KTKbdHk.dll: A valid keyboard hooking dll.
- %System%\acespy\Makecab.exe: A valid archive application.
- %System%\acespy\Mscomct2.ocx: A valid ActiveX component.
- %System%\acespy\Mscomctl.ocx: A valid ActiveX component.
- %System%\acespy\Msinet.ocx: A valid ActiveX component.
- %System%\acespy\Msmapi32.ocx: A valid ActiveX component.
- %System%\acespy\Mswinsck.ocx: A valid ActiveX component.
- %System%\acespy\Riched32.dll: A valid Windows dll.
- %System%\acespy\Richtx32.ocx: A valid ActiveX component.
- %System%\acespy\Shlwapi.dll: A valid Windows dll.
- %System%\acespy\Sysinfo.ocx: A valid ActiveX component.
- %System%\acespy\systune.exe: The spyware component.
- %System%\acespy\Tabctl32.ocx: A valid ActiveX component.
- %System%\acespy\Wininet.dll: A valid Windows dll.
- %System%\acespy\keylog<current_date>.log: A key log file. This is not malicious, and therefore, will not be detected.
- %System%\acespy\file<current_date_and_time>.jpg: A screenshot. This is not malicious, and therefore, will not be detected.
- %System%\ace16win.dll: A log file that is not malicious, and therefore, will not be detected.
Adds the value:

"regsvc"="%System%\acespy\systune"to the registry keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runso that the spyware runs when you start Windows.
Adds the value:

"systune"="%System%\acespy\systune.exe"to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runso that the spyware runs when you start Windows.
Adds the following values to the registry:

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}