Spyware.SpyGator

Printer Friendly Page

Updated: February 13, 2007 11:45:25 AM

Type: Spyware

Version: 1.2

Publisher: Thunder Technologies Inc.

Risk Impact: High

File Names: SpyGatorPro.msi SGP.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Spyware.SpyGator is installed, it performs the following actions:

Creates the following files:
- %UserProfile%\Desktop\Spy Gator Pro.lnk
- %UserProfile%\Start Menu\Programs\Thunder Technologies Inc. Software\Spy Gator Pro\Readme-Help.lnk
- %UserProfile%\Start Menu\Programs\Thunder Technologies Inc. Software\Spy Gator Pro\Spy Gator Pro.lnk
- %ProgramFiles%\SGP\EventScheduler.ldb
- %ProgramFiles%\SGP\EventScheduler.mdb
- %ProgramFiles%\SGP\Help.rtf
- %ProgramFiles%\SGP\riched32.dll
- %ProgramFiles%\SGP\SGP.exe (detected as Spyware.SpyGator)
- %Windir%\Installer\[random_name].msi
- %System%\actskn43.ocx
- %System%\dijpg.dll
- %System%\richtx32.ocx
- %System%\skinboxer43.dll
  
  Note:
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B4C147C7-6D21-4A04-A3F5-EC9BBB9B56E0} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData \S-1-5-21-1645522239-1085031214-839522115-1004\Components\1F1D4633D18348E4E9C8DA10ACC725AD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData \S-1-5-21-1645522239-1085031214-839522115-1004\Products\7C741C4B12D640A43A5FCEB9BBB9650E HKEY_LOCAL_MACHINE\SOFTWARE\Thunder Technologies Inc.\Spy Gator Pro HKEY_CURRENT_USER\Software\Microsoft\Installer\Products\7C741C4B12D640A43A5FCEB9BBB9650E HKEY_CURRENT_USER\Software\Microsoft\Installer\Features\7C741C4B12D640A43A5FCEB9BBB9650E HKEY_CURRENT_USER\Software\Microsoft\Installer\UpgradeCodes\BFB2FAA0D27B30648814077FE5D071CB HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs \Thunder Technologies Inc. Software\Spy Gator Pro
Adds the value:

"MSRegScan" = "%ProgramFiles%\SGP\SGP.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts.
Adds the values:
"%ProgramFiles%\SGP\" = "" "%UserProfile%\Start Menu\Programs\Thunder Technologies Inc. Software\Spy Gator Pro\" = "" "%UserProfile%\Start Menu\Programs\Thunder Technologies Inc. Software\" = ""

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Monitors Internet activity, logs keystrokes, and takes screenshots.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}