Spyware.Spytech.B

SUMMARY

Behavior

Spyware.Spytech.B is spyware that monitors user activity and takes periodic screenshots.

Symptoms

The files are detected as Spyware.Spytech.B.

Transmission

Spyware.Spytech.B must be manually installed.

Protection

• Virus Definitions (LiveUpdate™ Weekly) July 7, 2004
• Virus Definitions (Intelligent Updater) July 2, 2004

TECHNICAL DETAILS

Spyware.Spytech.B can:

• Take periodic screenshots to monitor user activity.
• Monitor Web activity by looking at the Web browser cache.
  

When Spyware.Spytech.B is installed it does the following:

1. Displays the license agreement.
   
   
2. Allows the person installing it to select the installation folder. The default installation folder is %ProgramFiles%Spytech SoftwareSpytech Shadow.
   
   Note: %ProgramFiles% is a variable that refers to the path to the program files folder. By default, this is C:Program Files.
   
   
3. Allows the individual who is installing it to select one of two installation types:
   
   • Normal: Installs program files, documentation files, and program shortcuts.
   • Stealth: Installs only program files.
     
     
4. Gives the option to install an uninstaller.
   
   
5. Creates the following files and folders:
   
   • %ProgramFiles%Spytech SoftwareSpytech ShadowShadow.exe: A log viewer and configurations manager, detected as Spyware.Spytech.B.
   • %ProgramFiles%Spytech SoftwareSpytech ShadowShadowModule.exe: The logging module, detected as Spyware.Spytech.B.
   • %System%libimg.dll: Win32 image I/O and manipulation library with GDI extensions.
   • %ProgramFiles%Spytech SoftwareSpytech Shadowlicense.txt: License information.
   • %ProgramFiles%Spytech SoftwareSpytech ShadowOrder Spytech Software Online!!.url. A link to an ordering Web site.
   • %ProgramFiles%Spytech SoftwareSpytech Shadowhelp.cnt: A Help file.
   • %ProgramFiles%Spytech SoftwareSpytech Shadowhelp.GID: A Help file.
   • %ProgramFiles%Spytech SoftwareSpytech ShadowHELP.HLP: A Help file.
   • %ProgramFiles%Spytech SoftwareSpytech Shadoweadme!.txt: Documentation.
   • %Windir%unvise32.exe: A generic uninstaller.
   • %ProgramFiles%Spytech SoftwareSpytech Shadowuninstall.log: A log that an uninstaller uses.
   • %Windir%shadopts.dat: Configurations.
   • %Windir%SHAgentSS: Screenshot directory.
   • C:Documents and SettingsAll UsersStart MenuProgramsSpytech ShadowSpyTech Shadow.lnk: Start menu link.
   • C:Documents and SettingsAll UsersStart MenuProgramsSpytech ShadowUser License.lnk: Start menu link.
   • C:Documents and SettingsAll UsersStart MenuProgramsSpytech ShadowOrder Spytech Software Online!!.lnk: Start menu link.
   • C:Documents and SettingsAll UsersStart MenuProgramsSpytech ShadowShadow Help.lnk: Start menu link.
   • C:Documents and SettingsAll UsersStart MenuProgramsSpytech ShadowShadow Readme.lnk: Start menu link.
   • C:Documents and SettingsAll UsersStart MenuProgramsSpytech ShadowRemove Spytech Shadow.lnk: Start menu link.
     
     
     Notes:
     • %System% is a variable. By default, this is C:WindowsSystem (Windows 95/98/Me), C:WinntSystem32 (Windows NT/2000), or C:WindowsSystem32 (Windows XP).
     • %Windir% is a variable. By default, this is C:Windows or C:Winnt.
     • Depending on the options selected during installation, certain files may not be present.
       
       
6. Adds the subkey:
   
   Spytech Shadow
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstall
   
   and then adds these values to that subkey:
   
   "DisplayName" = "Spytech Shadow"
   "UninstallString" = "%Windir%unvise32.exe %ProgramFiles%Spytech SoftwareSpytech Shadowuninstal.log"
   
   
7. Adds the value:
   
   "%Windir%unvise32.exe" = "0x1"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionSharedDlls

REMOVAL

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

Before you begin
This is a general removal procedure. This application may include an uninstallation tool named "unins000.exe" located in the installation folder. We suggest that, before you attempt to remove this spyware using the following instructions, try to uninstall it using the provided uninstaller.

1. Update the definitions.
2. Restart the computer in Safe mode.
3. Run a full system scan and delete all the files detected as Spyware.Spytech.B.
4. Delete the values that were added to the registry.
   

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To restart the computer in Safe mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode. For instructions, read the document, "How to start the computer in Safe Mode."

3. To scan for and delete the files

1. Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
2. Run a full system scan.
3. If any files are detected as Spyware.Spytech.B, click Delete.
   
   Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file names. Then use Windows Explorer to locate and delete the file.
   

4. To delete the value from the registry

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Note: This is done to make sure that all the keys are removed. They may not be there if the uninstaller removed them.

1. Click Start > Run.
2. Type regedit
   
   Then click OK.
   
   
3. Navigate to the key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionUninstall
   
   
4. In the left plane, delete the subkey:
   
   Spytech Shadow
   
   
5. Navigate to the key:
   
   HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionSharedDlls
   
   
6. In the left plane, delete the value:
   
   "%Windir%unvise32.exe" = "0x1"
   
   
7. Exit the Registry Editor.