Monday, December 1, 2008

Screen.Spy Spyware

Removing Screen.Spy
Categories: Spyware
Spyware can even change computer settings, resulting in slow connection speeds,
different home pages, and loss of Internet or other programs.
In an attempt to increase the understanding of spyware, a more formal classification
of its included software types is captured under the term privacy-invasive software.

Visible Symptoms:
Files in system folders:
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\CopDad.lnk
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\Uninstall.lnk
[%DESKTOP%]\CopDad.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy Uninstall.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy.lnk
[%SYSTEM%]\svc_copdadnotify.exe
[%SYSTEM%]\WSpyNotify.dll
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\CopDad.lnk
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\Uninstall.lnk
[%DESKTOP%]\CopDad.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy Uninstall.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy.lnk
[%SYSTEM%]\svc_copdadnotify.exe
[%SYSTEM%]\WSpyNotify.dll

How to detect Screen.Spy:

Files:
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\CopDad.lnk
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\Uninstall.lnk
[%DESKTOP%]\CopDad.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy Uninstall.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy.lnk
[%SYSTEM%]\svc_copdadnotify.exe
[%SYSTEM%]\WSpyNotify.dll
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\CopDad.lnk
[%COMMON_PROGRAMS%]\VirtualLTD\CopDad 1.2\Uninstall.lnk
[%DESKTOP%]\CopDad.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy Uninstall.lnk
[%PROGRAMS%]\Screen Spy\Screen Spy.lnk
[%SYSTEM%]\svc_copdadnotify.exe
[%SYSTEM%]\WSpyNotify.dll

Folders:
[%PROGRAMS%]\VirtualLTD\CopDad 1.2
[%PROGRAM_FILES%]\VirtualLTD\CopDad\1.2\ScreenSpy
[%SYSTEM%]\ScreenRX

Registry Keys:
HKEY_CLASSES_ROOT\appid\usernotificationservice.exe
HKEY_CLASSES_ROOT\appid\{4c6aade3-6d03-4869-b1a5-4750e8119187}
HKEY_CLASSES_ROOT\clsid\{44c2335c-d46e-4b26-9992-2f85007d2c0c}
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\en-us\vl.copdad.resources.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\en-us\vl.screenspy.gui.resources.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\fr-fr\vl.copdad.resources.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\fr-fr\vl.screenspy.gui.resources.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\svc_copdad.exe
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\svc_copdadnotify.exe
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.controls.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.copdad.exe
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.copdad.server.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.data.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.screenspy.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.screenspy.gui.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.screenspy.screencapture.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.utilitylibrary.dll
HKEY_CLASSES_ROOT\installer\assemblies\[%SYSTEM%]\svc_copdadnotify.exe
HKEY_CLASSES_ROOT\installer\assemblies\[%SYSTEM%]\wspynotify.dll
HKEY_CLASSES_ROOT\installer\features\3f4d9c16cddd31c43a6f7f27526a3c69
HKEY_CLASSES_ROOT\installer\products\3f4d9c16cddd31c43a6f7f27526a3c69
HKEY_CLASSES_ROOT\installer\upgradecodes\feb8a0addbee86a40a842039fbdffe15
HKEY_CLASSES_ROOT\interface\{8612bb6d-e63f-4f01-a8d0-466e55700a09}
HKEY_CLASSES_ROOT\typelib\{07d9341d-a478-4e28-af7c-57bbcbfbd8a9}
HKEY_CLASSES_ROOT\usernotificationservice.usernotificat.1
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\en-us\vl.copdad.resources.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\en-us\vl.screenspy.gui.resources.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\fr-fr\vl.copdad.resources.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\fr-fr\vl.screenspy.gui.resources.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\svc_copdad.exe
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\svc_copdadnotify.exe
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.controls.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.copdad.exe
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.copdad.server.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.data.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.screenspy.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.screenspy.gui.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.screenspy.screencapture.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%PROGRAM_FILES%]\virtualltd\copdad\1.2\screenspy\vl.utilitylibrary.dll
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%SYSTEM%]\svc_copdadnotify.exe
HKEY_CURRENT_USER\software\microsoft\installer\assemblies\[%SYSTEM%]\wspynotify.dll
HKEY_CURRENT_USER\software\microsoft\installer\features\3f4d9c16cddd31c43a6f7f27526a3c69
HKEY_CURRENT_USER\software\microsoft\installer\products\3f4d9c16cddd31c43a6f7f27526a3c69
HKEY_CURRENT_USER\software\microsoft\installer\upgradecodes\feb8a0addbee86a40a842039fbdffe15
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\screen spy trial_is1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{61c9d4f3-dddc-4c13-a3f6-f77225a6c396}
HKEY_LOCAL_MACHINE\software\virtualltd\copdad\10\virtual screen spy
HKEY_LOCAL_MACHINE\system\controlset001\services\copdad 1.0 service
HKEY_LOCAL_MACHINE\system\controlset001\services\eventlog\application\copdad 1.0 service
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\copdad 1.0 service
HKEY_LOCAL_MACHINE\system\currentcontrolset\services\eventlog\application\copdad 1.0 service

Registry Values:
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\copdad
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run

Removing Screen.Spy:

You can download trial version of "Exterminate-It" antivirus software here, to check your computer instantly.

Or buy it to remove ALL viruses from your computer.

Also Be Aware of the Following Threats:
Free.Keylogger Spyware Symptoms
Sin.Static.Ip RAT Symptoms

No comments: