Spyware.TrueActive

Updated:

February 13, 2007 11:39:27 AM

Type:

Spyware

Version:

5.0

Publisher:

TrueActive

Risk Impact:

High

File Names:

_.exe,tamset.exe,sem.dll,winsdoc.dll,winlogon.exe

Systems Affected:

Windows 2000, Windows 98, Windows Me, Windows Server 2003, Windows XP

Behavior

Spyware.TrueActive is the commercial keylogger TrueActive Monitor. Formerly known as WinWhatWhere Investigator, TrueActive Software published this spyware.

The spyware has a comprehensive suite of system monitoring tools including, keystroke, password, instant messaging, video/screen capture, and network usage logging. It can also operate in silent mode and can also use email to send logs to a remote observer.

Also see the Spyware.WinWhatWhere writeup for more information.

Symptoms

One or more files is detected as Spyware.TrueActive.

Transmission

Spyware.TrueActive must be manually installed.

Antivirus Protection Dates

• Initial Rapid Release version September 14, 2004
• Latest Rapid Release version September 28, 2010 revision 054
• Initial Daily Certified version September 14, 2004
• Latest Daily Certified version September 28, 2010 revision 036
• Initial Weekly Certified release date September 15, 2004