Spyviper

SUMMARY

Behavior

SpyViper is a security risk that may give exaggerated reports of threats on the computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported threats.

Symptoms

Your Symantec program detects SpyViper.

Transmission

This security risk is manually downloaded and installed.

Protection

• Virus Definitions (LiveUpdate™ Daily) April 5, 2006
• Virus Definitions (LiveUpdate™ Weekly) April 5, 2006
• Virus Definitions (Intelligent Updater) April 5, 2006
• Virus Definitions (LiveUpdate™ Plus) April 5, 2006

TECHNICAL DETAILS

When ScanandRepair is installed, it performs the following actions:

1. Creates the following folder:
   
   %ProgramFiles%SpyViper Demo
   
   Note: %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:Program Files.
   
   
2. Creates the following files:
   
   
   • C:Program FilesSpyViper DemoAppRestart.exe
   • C:Program FilesSpyViper DemoBlockedCookies.dat
   • C:Program FilesSpyViper DemoExeDefinition.dat
   • C:Program FilesSpyViper DemoFileDefinition.dat
   • C:Program FilesSpyViper Demohelp.chm
   • C:Program FilesSpyViper DemoRegistryDefinition.dat
   • C:Program FilesSpyViper Demoiched32.dll
   • C:Program FilesSpyViper DemoScan_Log.txt
   • C:Program FilesSpyViper DemoSpyViper.com.url
   • C:Program FilesSpyViper DemoSpyViperDemo.exe
   • C:WINDOWSInstaller[random ].msi
   • C:WINDOWSsystem32actskn43.ocx
   • C:WINDOWSsystem32mscomct2.ocx
   • C:WINDOWSsystem32mscomctl.ocx
   • C:WINDOWSsystem32ichtx32.ocx
   • C:WINDOWSsystem32skinboxer43.dll
   • C:WINDOWSsystem32 abctl32.ocx
   • C:Documents and SettingsAdministratorDesktopSpyViper Demo.lnk
   • C:Documents and SettingsAdministratorStart MenuProgramsSpyViper.com SoftwareSpyViper DemoReadme-Help.lnk
   • C:Documents and SettingsAdministratorStart MenuProgramsSpyViper.com SoftwareSpyViper DemoSpyViper Demo.lnk
   • C:Documents and SettingsAdministratorStart MenuProgramsSpyViper.com SoftwareSpyViper DemoSpyViper.com.url
   • C:Documents and SettingsAdministratorApplication DataMicrosoftInstaller{7D77157C-CB0B-443B-A62A-8BCA496BA488}[random].exe
     
     
3. Creates the following registry subkeys:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodesDE3CB23B70E487F42BC60E58932FB63E
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall{7D77157C-CB0B-443B-A62A-8BCA496BA488}
   HKEY_ALL_USERSSoftwareMicrosoftInstallerFeaturesC75177D7B0BCB3446AA2B8AC94B64A88
   HKEY_ALL_USERSSoftwareMicrosoftInstallerProductsC75177D7B0BCB3446AA2B8AC94B64A88
   HKEY_ALL_USERSSoftwareMicrosoftInstallerUpgradeCodesDE3CB23B70E487F42BC60E58932FB63E
   HKEY_LOCAL_MACHINESOFTWARESpyViper.com
   HKEY_ALL_USERSSoftwareUnSpyPC
   HKEY_ALL_USERSSoftwareVB and VBA Program SettingsAdwareRemovalSoftware
   HKEY_ALL_USERSSoftwareVB and VBA Program SettingsSpyViper
   
   
4. Adds the value:
   
   "SpyViperDemo" = "C:Program FilesSpyViper DemoSpyViperDemo"
   
   to the registry subkey:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
   
   so that it is executed every time Windows starts.
   
   
5. Adds the values:
   
   "C:Program FilesSpyViper Demo" = ""
   "C:Documents and SettingsAdministratorStart MenuProgramsSpyViper.com Software" = ""
   "C:Documents and SettingsAdministratorStart MenuProgramsSpyViper.com SoftwareSpyViper Demo" = ""
   "C:Documents and SettingsAdministratorApplication DataMicrosoftInstaller{7D77157C-CB0B-443B-A62A-8BCA496BA488}" = ""
   
   to the registry subkey:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders

REMOVAL

The following instructions pertain to all Symantec antivirus products that support security risk detection.

1. Update the definitions.
2. Uninstall the security risk.

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To uninstall the security risk
This security risk includes an uninstallation applet. In order to uninstall this security risk, complete the following instructions:

1. Click Start > Settings > Control Panel or Start > Control Panel (this varies with the operating system).
   
   
2. In the Control Panel window, double-click Add/Remove Programs.
   
   Windows Me only: If you do not see the Add/Remove Programs icon, click ...view all Control Panel options.
   
   
3. Click "´SpyViper Demo"
   
   Note: You may need to use the scroll bar to view the whole list.
   
   
4. Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.
   
   Note: After running the Add/Remove programs applet, all the files may have been removed. You will want to run a full system scan to ensure that this is the case. However, it is possible that no files will be detected after using Add/Remove programs.