Spyware.UserLogger

Updated: February 13, 2007 11:44:52 AM

Type: Spyware

Version: 2.9

Publisher: Chemware Ltd

Risk Impact: Medium

File Names: usrlogfw.exe UsrLog.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.UserLogger is installed, it does the following:

Creates the following files and folders:
- %UserProfile%\Start Menu\Programs\User Logger\Read Me.lnk
- %UserProfile%\Start Menu\Programs\User Logger\Uninstall User Logger.lnk
- %UserProfile%\Start Menu\Programs\User Logger\User Logger Help.lnk
- %UserProfile%\Start Menu\Programs\User Logger\User Logger.lnk
- %ProgramFiles%\User Logger\Keywords.dta
- %ProgramFiles%\User Logger\tod.txt
- %ProgramFiles%\User Logger\unins000.dat
- %ProgramFiles%\User Logger\unins000.exe
- %ProgramFiles%User Logger\UserLog.txt
- %ProgramFiles%\User Logger\usrlog.cnt
- %ProgramFiles%\User Logger\UsrLog.exe
- %ProgramFiles%\User Logger\usrlog.hlp
- %ProgramFiles%\User Logger\UsrLog.ini
  
  Note:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Adds the value:

"User Logger" = "%ProgramFiles%\User Logger\UsrLog.exe run"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the security risk runs every time Windows starts.
Creates the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\User Logger_is1

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}