Spyware.WinGuardian

Spyware.WinGuardian is a Windows-monitoring utility that runs stealthily and records all the activities.

This program logs what programs are run, text that is typed into the programs, Web sites visited, and captures screenshots.

When Spyware.WinGuardian is installed and run, it performs the following actions:

1. Adds the value:
   
   "System"="C:\WINNT\system\sysctrl.exe /a"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
   so that the spyware is run every time that Windows starts.
   
   
2. Adds the following subkey:
   
   HKEY_LOCAL_MACHINE\Software\CPNE
   
   and adds several registry values to this subkey.
   
   
3. Creates the following files:
   • %SystemDrive%\Windows\System\system.in
   • %SystemDrive%\Windows\System\wglogs\system.lg
   • %SystemDrive%\Windows\System\wglogs\sc
   • %SystemDrive%\Windows\System\aup.in
   • %SystemDrive%\Windows\System\img.jpg
   • %SystemDrive%\Windows\System\message.in
   • %SystemDrive%\Windows\System\keyhook.dll
   • %SystemDrive%\Windows\System\sysctrl.exe
   • %SystemDrive%\Windows\System\chapinfo.txt
   • %SystemDrive%\Windows\System\unchap.drv
   • %SystemDrive%\Windows\System\sysfiles.in
   • %SystemDrive%\Windows\System\sys.exe
   • %SystemDrive%\Windows\System\sys.htm
     
     Note: %SystemDrive% is a variable that refers to the drive on which the Windows installation resides. By default, this is drive C.
     
     
4. Runs stealthily in the background. To view the logs and change settings, you must use hot keys. The default hot keys are Ctrl+Alt+Shift+Y.
   
   
5. Can be set to block specific Web sites.
   
   
6. Send logs to an email address.

Summary