Spyware.DSpy

SUMMARY

Behavior

Spyware.DSpy is a program that takes screenshots on your computer.

Symptoms

The files are detected as Spyware.DSpy.

Transmission

Spyware.DSpy must be manually installed.

Protection

• Virus Definitions (LiveUpdate™ Weekly) July 15, 2004
• Virus Definitions (Intelligent Updater) July 15, 2004

TECHNICAL DETAILS

Spyware.DSpy is a screen capture program.

When Spyware.DSpy is installed, it does the following:

1. Allows the choice of the installation folder. The default installation folder is %ProgramFiles%DS.
   
   Note: %ProgramFiles% is a variable that refers to the path to the program files folder. By default, this is C:Program Files.
   
   
2. Allows the choice of the Start Menu folder. The default is Desktop Spy 4.0.
   
   
3. Creates the following folders and files:
   
   • %ProgramFiles%DSUNWISE.EXE: Generic uninstaller.
   • %System%ijl11.dll: Intel JPEG Library.
   • %System%msvbvm60.dll: Microsoft Visual Basic Virtual Machine Library.
   • %ProgramFiles%DSDSPY.exe: Screenshot logger, detected as Spyware.DSpy.
   • %ProgramFiles%DSijl11.dll: Intel JPEG Library.
   • %ProgramFiles%DSConfig.exe: Screenshot logger manager/viewer, detected as Spyware.DSpy.
   • %ProgramFiles%DSDSPY.cnt: The help file uses this.
   • %ProgramFiles%DSDspy.hlp: Help file.
   • C:Documents and SettingsAdministratorStart MenuProgramsDesktop Spy 4.0Desktop Spy Configuration.lnk: Start menu link.
   • C:Documents and SettingsAdministratorStart MenuProgramsDesktop Spy 4.0Desktop Spy Help.lnk: Start menu link.
   • %ProgramFiles%DSINSTALL.LOG: Installation information.
   • C:WindowsDHPY: Log files.
     
     Note: %System% is a variable. The worm locates the System folder and copies the files to that location. By default, this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).
     
     
4. Adds the value:
   
   "DHPY" = "%ProgramFiles%DSDSPY.EXE"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
   
   so that the spyware runs when you start Windows.
   
   
5. Adds the following registry keys and values:
   
   • HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstallDesktop Spy 4.0DisplayName = "Desktop Spy 4.0"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstallDesktop Spy 4.0UninstallString = "C:PROGRA~1DSUNWISE.EXE C:PROGRA~1DSINSTALL.LOG"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPChange = "0"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPClose = ""
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault01 = "1"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault02 = "6"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault03 = "10"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault04 = "Picture"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault05 = "C:WindowsDHPY"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault06 = ".JPG"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault07 = "1"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault08 = "1"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPDefault09 = "50000"
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPLockKey = ""
   • HKEY_LOCAL_MACHINESoftwareMicrosoftNKJBMPPassword = "0"
   • HKEY_LOCAL_MACHINESoftwareNGBDefault = "B2AC12BF"
     
     
6. Adds the following registry keys/values:
   
   • HKEY_CLASSES_ROOTCLSID{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}(Default) = "VBPropertyBag"
   • HKEY_CLASSES_ROOTCLSID{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}InProcServer32(Default) = "%System%msvbvm60.dll"
   • HKEY_CLASSES_ROOTCLSID{D5DE8D20-5BB8-11D1-A1E3-00A0C90F2731}InProcServer32ThreadingModel = "Apartment"
     
   • HKEY_CLASSES_ROOTTypeLib{000204EF-0000-0000-C000-000000000046}6.09win32(Default) = "%System%msvbvm60.dll"
     
   • HKEY_CLASSES_ROOTTypeLib{EA544A21-C82D-11D1-A3E4-00A0C90AEA82}6.09win32(Default) = "%System%msvbvm60.dll3"
     
   • HKEY_LOCAL_MACHINESystemCurrentControlSetServicesEventLogApplicationVBRuntimeEventMessageFile = "%System%msvbvm60.dll"
   • HKEY_LOCAL_MACHINESystemCurrentControlSetServicesEventLogApplicationVBRuntimeTypesSupported = "0x4"
     
     to set up the Visual Basic environment required for running the Spyware.

REMOVAL

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

1. Update the definitions.
2. Uninstall Spyware.DSpy.
3. Restart the computer in Safe mode.
4. Run a full system scan and delete all the files detected as Spyware.DSpy.
5. Delete the values that were added to the registry.
   

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To uninstall the spyware

1. Navigate to %ProgramFiles%DS.
2. Double-click UNWISE.EXE.

3. To restart the computer in Safe mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode. For instructions, read the document, "How to start the computer in Safe Mode."

4. To scan for and delete the files

1. Start your Symantec antivirus program, and then run a full system scan.
2. If any files are detected as Spyware.DSpy, click Delete.
   
   Notes:

• If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.
• If you ran the Add/Remove programs applet as described in the previous section, all the files may have been removed, and thus none of them will be detected.

5. To delete the values from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.


Note: This is done to make sure that all the keys are removed. They may not be there if the uninstaller removed them.

1. Click Start > Run.
2. Type regedit
   
   Then click OK.
   
   
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstall
   
   
4. In the left plane, delete the subkey:
   
   Desktop Spy 4.0
   
   
5. Navigate to the key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoft
   
   
6. In the left plane, delete the subkey:
   
   NKJBMP
   
   
7. Navigate to the key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
   
   
8. In the right plane, delete the value:
   
   "DHPY" = "C:PROGRAM FILESDSDSPY.EXE"
   
   
9. Navigate to the key:
   
   HKEY_LOCAL_MACHINESoftware
   
   
10. In the left plane, delete the value:
    
    "NGBDefault" = "B2AC12BF"
    
    
11. Exit the Registry Editor.
    
    
12. Restart the computer in Safe mode.