Once installed on the computer, Spyware.TinySpyAgent performs the following actions:
1. Creates the following files:
- %ProgramFiles%\TinyStone\Tiny Spy Agent\sagent.exe (main logging program, detected as Spyware.TinySpyAgent)
- %ProgramFiles%\TinyStone\Tiny Spy Agent\keymap.dll (keyboard hook, detected as Spyware.TinySpyAgent)
- %ProgramFiles%\TinyStone\Tiny Spy Agent\help.htm
- %System%\sinastar.dll (event monitoring library, detected as Spyware.TinySpyAgent)
Notes:
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
2. Creates the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\TinyStone\Tiny Spy Agent
3. Adds the value:
"SAGENTSERVICE"="%ProgramFiles%\TinyStone\Tiny Spy Agent\Sagent.exe -start"
to the registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the keylogger runs when you start Windows.
