Spyware.NetMonitor

Printer Friendly Page

Updated: February 13, 2007 11:47:43 AM

Type: Spyware

Publisher: www.NetworkLookOut.com

Risk Impact: High

File Names: NLSAgent.exe NLSAgentSvc.exe NLSAgtConfig.exe NLSupervisor.exe

Systems Affected: Windows 2000, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.NetMonitor is executed, it performs the following actions:

Creates the following files:
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\Buy License Key.lnk
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\Help.lnk
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\Net Monitor for Employees Agent Configuration.lnk
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\Net Monitor for Employees.lnk
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\NetworkLookOut.com.lnk
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\Readme.lnk
- %UserProfile%\Start Menu\Programs\Network LookOut\Net Monitor for Employees\Uninstall.lnk
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\bin\NLSAgent.exe
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\bin\NLSAgentSvc.exe
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\bin\NLSAgtConfig.exe
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\bin\NLSupervisor.exe
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\bin\NMEmployees.hlp
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\conf\ctrlagt.cfg
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\ebuynow.url
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\eweb.url
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\LICENSE.TXT
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\README.TXT
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\unins000.dat
- %ProgramFiles%\Network LookOut\Net Monitor for Employees\unins000.exe
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Advanced Net Monitor for Classroom.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Buy License Key.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\EduIQ.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Help.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Net Objective Settings.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Readme.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Restart Net Objective.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Start Net Objective.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Stop Net Objective.lnk
- %UserProfile%\Start Menu\Programs\EduIQ.com\Advanced Net Monitor for Classroom\Uninstall.lnk
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\advctrl.dll
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\ebuynow.url
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\eEduIQ.url
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\LICENSE.TXT
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\netmon.exe
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\netmon.hlp
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\netobj.exe
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\NETOBJ.OPT
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\nobjset.exe
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\port.ini
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\Readme.txt
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\unins000.dat
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\unins000.exe
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\unins001.dat
- %ProgramFiles%\EduIQ.com\Advanced Net Monitor for Classroom\unins001.exe
  
  Note:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Creates the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Monitor for Employees Console_is1HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Advanced Net Monitor for Classroom_is1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Objective_is1HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NMEmployeesAgent HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NMEmployeesAgent
Opens a TCP port and listens. A remote user can get a real-time screenshot of computer's desktop.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}