Spyware.SurfSpy

When Spyware.SurfSpy is installed, it performs the following actions:

1. Shows the end user license agreement.


2. Prompts a user asking which folder the programs are to be installed.


3. Creates the specified folder if it is not present. It also creates the subfolder system.


4. Copies the following files:

• <installed path>\config.exe
• <installed path>\faq.html
• <installed path>\manual.html
• <installed path>\uninstall.bat
• <installed path>\system\sescli.cfg
• <installed path>\system\sescli.exe
  
  

5. Allows the user to perform any of the following actions:

• Start the spyware program automatically when the system is restarted and adds the values:
  

"Session Client" = "<installed path>\sescli.exe"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

• Log all the Internet activity, including the visited Web sites, user name, IP addresses, computer name, and access times, into a password-protected encrypted file.
• Send email messages with encrypted log files attached secretly to a specified email address.
• Log to a server running a dedicated server-side program waiting for incoming connections on a specified port.

Summary