Spyware.MessageSpy

Printer Friendly Page

Updated: February 13, 2007 11:43:46 AM

Type: Spyware

Version: 3.1.1

Publisher: Zemerick Software, Inc.

Risk Impact: High

File Names: setup.exe msaolim.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Spyware.MessageSpy is installed, it performs the following actions:

Creates the following files:
- %UserProfile%\Start Menu\Programs\Zemerick Software\Message Spy\Message Spy Documentation.lnk
- %UserProfile%\Start Menu\Programs\Zemerick Software\Message Spy\Message Spy.lnk
- %ProgramFiles%\msaolim\Message Spy Documentation.url
- %ProgramFiles%\msaolim\msaolim.exe
- %ProgramFiles%\msaolim\ms_index.html
- %ProgramFiles%\msaolim\notification.html
- %ProgramFiles%\msaolim\settings.dat
- %ProgramFiles%\msaolim\unins.exe
- %ProgramFiles%\msaolim\unins000.dat
- %ProgramFiles%\msaolim\unins000.exe
- %System%\comdlg32.ocx -- This is a non-malicious component that may be used by other applications.
- %System%\polarcrypto.dll -- This is a non-malicious component that may be used by other applications.
- %System%\polarziplight.dll -- This is a non-malicious component that may be used by other applications.
- %System%\Richtx32.ocx -- This is a non-malicious component that may be used by other applications.
  
  Notes:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Adds the value:

"msaim" = "C:\Program Files\msaolim\msaolim.exe"
to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\
so that the spyware runs when you start Windows.

Note: This value is added if loading at windows boot time option is enabled.
Records online chat conversations.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}