Spyware.ISpy

Printer Friendly Page

Updated: February 13, 2007 11:44:33 AM

Type: Spyware

Version: 1.5

Publisher: J.T. Software

Risk Impact: High

File Names: setup.exe Help.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.ISpy is installed, it performs the following actions:

Creates the following files:
- %UserProfile%\Start Menu\Programs\Help\I-Spy on the Web.lnk
- %UserProfile%\Start Menu\Programs\Help\I-Spy.lnk
- %UserProfile%\Start Menu\Programs\Help\Read Me First.lnk
- %UserProfile%\Start Menu\Programs\Help\Uninstall I-Spy.lnk
- %UserProfile%\Desktop\I-Spy.lnk
- %ProgramFiles%\Helper\Help.exe
- %ProgramFiles%\Helper\I-Spy.url
- %ProgramFiles%\Helper\min.dat
- %ProgramFiles%\Helper\readme.txt
- %ProgramFiles%\Helper\unins000.dat
- %ProgramFiles%\Helper\unins000.exe
- %System%\cat.dll
- %Windir%\ispy.dll
  
  Note:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Creates the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I-Spy
Adds the value:

"ISHelp" = "%ProgramFiles%\helper\help.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts.
Modifies the value:

"ProductNonBootFiles" = "0x32BF001B"

in the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer \UserData\S-1-5-18\Products\904000001E872D116BF00006799C897E\Usage
Logs keystrokes and captures screenshots.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}