Tuesday, October 21, 2008

NetSpy.KeyLogger Spyware

Removing NetSpy.KeyLogger
Categories: Spyware
Spyware programs can collect various types of personal information,
such as Internet surfing habit, sites that have been visited,
but can also interfere with user control of the computer in other ways,
such as installing additional software, redirecting Web browser activity,
accessing websites blindly that will cause more harmful viruses,
or diverting advertising revenue to a third party.

Visible Symptoms:
Files in system folders:
[%SYSTEM%]\captur~1.ocx
[%SYSTEM%]\kbhook.dll
[%SYSTEM%]\capturescreen.ocx
[%SYSTEM%]\nconfig.exe
[%SYSTEM%]\nsutil.exe
[%SYSTEM%]\nsys.exe
[%SYSTEM%]\captur~1.ocx
[%SYSTEM%]\kbhook.dll
[%SYSTEM%]\capturescreen.ocx
[%SYSTEM%]\nconfig.exe
[%SYSTEM%]\nsutil.exe
[%SYSTEM%]\nsys.exe

How to detect NetSpy.KeyLogger:

Files:
[%SYSTEM%]\captur~1.ocx
[%SYSTEM%]\kbhook.dll
[%SYSTEM%]\capturescreen.ocx
[%SYSTEM%]\nconfig.exe
[%SYSTEM%]\nsutil.exe
[%SYSTEM%]\nsys.exe
[%SYSTEM%]\captur~1.ocx
[%SYSTEM%]\kbhook.dll
[%SYSTEM%]\capturescreen.ocx
[%SYSTEM%]\nconfig.exe
[%SYSTEM%]\nsutil.exe
[%SYSTEM%]\nsys.exe

Folders:
[%PROGRAMS%]\netspy configurator.lnk

Registry Keys:
HKEY_CLASSES_ROOT\capturescreens.capturescreen
HKEY_CLASSES_ROOT\clsid\{5508498f-7911-11d4-92d5-00105a1a0059}
HKEY_CLASSES_ROOT\clsid\{55084990-7911-11d4-92d5-00105a1a0059}
HKEY_CLASSES_ROOT\clsid\{55084991-7911-11d4-92d5-00105a1a0059}
HKEY_CLASSES_ROOT\clsid\{55084995-7911-11d4-92d5-00105a1a0059}
HKEY_CLASSES_ROOT\interface\{55084990-7911-11d4-92d5-00105a1a0059}
HKEY_CLASSES_ROOT\interface\{55084995-7911-11d4-92d5-00105a1a0059}
HKEY_CLASSES_ROOT\typelib\{5508498f-7911-11d4-92d5-00105a1a0059}
HKEY_LOCAL_MACHINE\software\classes\capturescreens.capturescreen
HKEY_LOCAL_MACHINE\software\classes\clsid\{55084991-7911-11d4-92d5-00105a1a0059}
HKEY_LOCAL_MACHINE\software\classes\interface\{55084990-7911-11d4-92d5-00105a1a0059}
HKEY_LOCAL_MACHINE\software\classes\interface\{55084995-7911-11d4-92d5-00105a1a0059}
HKEY_LOCAL_MACHINE\software\classes\typelib\{5508498f-7911-11d4-92d5-00105a1a0059}
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\nsys.exe
HKEY_LOCAL_MACHINE\software\s7000\string1

Registry Values:
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\netspy
HKEY_CURRENT_USER\software\s7000\string1
HKEY_CURRENT_USER\software\s7000\string2
HKEY_LOCAL_MACHINE\hardware\resourcemap\pnp manager\pnpmanager
HKEY_LOCAL_MACHINE\hardware\resourcemap\pnp manager\pnpmanager
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shareddlls
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy
HKEY_LOCAL_MACHINE\software\netspy

Removing NetSpy.KeyLogger:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Zlob.Fam.Internet Explorer Secure Plug-in Trojan Symptoms
ForBot Trojan Removal instruction
Emusaffil Trojan Removal
Essgol Trojan Removal
Agent.kf Trojan Removal instruction

No comments: