Updated: February 13, 2007 11:39:21 AM
Type: Spyware
Publisher: Softdd
Risk Impact: High
File Names: Pcs.exe,Crrst32.exe
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
When Spyware.PCSpy is run, it does the following:
- Creates the following files and folders:
- %ProgramFiles%\PCS\pcs.exe (Executable for setting options)
- %Windir%\Crrst32.exe (Executable that captures screen images)
- %Windir%\Temp_Ig (Folder where the .sdd screenshot files are stored)
Notes:
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- Adds the value:
"Dconfig7"="%Windir%\crrst.32.exe"
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that Spyware.PCSpy runs when you start Windows.
Technorati
Digg
Delicious
Reddit
StumbleUpon
Yahoo Buzz
Twitter
Facebook
Newsvine
