Updated: February 13, 2007 11:44:32 AM
Type: Spyware
Version: 3.0.2
Publisher: Spy4PC.COM
Risk Impact: High
File Names:
Spy4PCSetup.exe
msudp.dll
sfpc.exe
sfpcinfo.exe
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
When Spyware.Spy4PC is installed, it performs the following actions:
- Creates the following files:
- %UserProfile%\Start Menu\Programs\SPY4PC\Spy4PC Info.lnk
- %UserProfile%\Start Menu\Programs\SPY4PC\Spy4PC.lnk
- %UserProfile%\Start Menu\Programs\SPY4PC\Uninstall Spy4PC.lnk
- %UserProfile%\Application Data\sfpc.dat
- %UserProfile%\Desktop\Spy4pc Info.lnk
- %ProgramFiles%\WinPcap\NetMonInstaller.exe
- %System%\gi44.tmp
- %System%\gi45.tmp
- %System%\gi46.tmp
- %System%\msipv6.dll
- %System%\msudp.dll
- %System%\pppoe32.dll
- %System%\sfpc.chm
- %System%\sfpc.dat
- %System%\sfpc.exe
- %System%\sfpcinfo.exe
- %System%\unins000.dat
- %System%\unins000.exe
- %System%\wanpacket.dll
- %System%\WinPcap_3_1_beta_3.exe
Notes:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- Adds the value:
"sfpc" = "%System%\sfpc.exe"
to the registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
so that the risk runs every time Windows starts.
- Monitors user activity, logs keystrokes, and takes screenshots.
Technorati
Digg
Delicious
Reddit
StumbleUpon
Yahoo Buzz
Twitter
Facebook
Newsvine
