Spyware.QuickLaunch

Printer Friendly Page

Updated: February 13, 2007 11:45:15 AM

Type: Spyware

Version: 2.0

Publisher: ReadmeSoft

Risk Impact: High

File Names: Setup.exe Keystroke.exe mousehook.dll

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Spyware.QuickLaunch is installed, it performs the following actions:

Creates the following files:
- %UserProfile%\Start Menu\Programs\Quick Launch\Help.lnk
- %UserProfile%\Start Menu\Programs\Quick Launch\Quick Launch v1.5.lnk
- %UserProfile%\Start Menu\Programs\Quick Launch\readme.lnk
- %UserProfile%\Start Menu\Programs\Quick Launch\Uninstall Quick Launch Shortcut.lnk
- %UserProfile%\Desktop\Quick Launch.lnk
- %ProgramFiles%\Quick Launch\[Date].txt
- %ProgramFiles%\Quick Launch\datetime.txt
- %ProgramFiles%\Quick Launch\href.txt
- %ProgramFiles%\Quick Launch\jkui.dll
- %ProgramFiles%\Quick Launch\keystroke.chm
- %ProgramFiles%\Quick Launch\Keystroke.exe
- %ProgramFiles%\Quick Launch\letr.txt
- %ProgramFiles%\Quick Launch\mousehook.dll
- %ProgramFiles%\Quick Launch\powkbsys.dat
- %ProgramFiles%\Quick Launch\readme.txt
- %ProgramFiles%\Quick Launch\unins000.dat
- %ProgramFiles%\Quick Launch\unins000.exe
- %System%\sys.ini
  
  Notes:
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Quick Launch Shortcut_is1 HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\keystroke
Adds the value:

"keystroke" = "%ProgramFiles%\Quick Launch\keystroke.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts
Logs keystrokes and captures screenshots.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}