McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program." It is a system monitoring "spy" application designed to log all activity performed on the host computer. The host system can also be remotely configured/inspected using the "System Spy Server" companion application. A user interface is displayed on launching the installation executable. No license agreement is shown during installation.

Privacy

There are profound privacy implications for any users of a computer on which the logging software is installed. Screenshots, keylogs, email and a detailed application and web browsing history are recorded. The software can be configured to upload logged data via email or FTP at regular intervals to any destination of choice. Additionally, the logs can audited over the network using the remote administration tool.

System Changes

General defaults for typical environment variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files

Files Added

For the client logging component:

• Installer: absystemspy.exe (635 KB)
  MD5: 57CFF5FD04806F33523AF98353551893
  
• c:\program files\ssystem v5.1.1 build 3\unins000.exe (71 KB)
  
• c:\program files\ssystem v5.1.1 build 3\unins000.dat (6 KB)
  
• c:\program files\ssystem v5.1.1 build 3\system.exe (163 KB)
  MD5: 7BFCEAFDA2F1B3ABE13560A198AA19CE
  
• c:\program files\ssystem v5.1.1 build 3\mswinsck.ocx* (105 KB)
  
• c:\program files\ssystem v5.1.1 build 3\license.txt (1 KB)
  
• c:\program files\ssystem v5.1.1 build 3\ijl15.dll* (344 KB)
  
• c:\program files\ssystem v5.1.1 build 3\defaults.reg (1 KB)
  
• c:\program files\ssystem v5.1.1 build 3\abss.url (1 KB)
  
• c:\program files\ssystem v5.1.1 build 3\abss.chm (20 KB)
  
• c:\program files\ssystem v5.1.1 build 3\administrator\log.htm (1 KB)
  
• c:\program files\ssystem v5.1.1 build 3\administrator\jue-1.jpg (1 KB)
  
• c:\documents and settings\all users\start menu\programs\ssystem v5.1.1 build 3\visit our website.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\ssystem v5.1.1 build 3\uninstall ab system spy v5.1.1 build 3.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\ssystem v5.1.1 build 3\read user manual.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\ssystem v5.1.1 build 3\license.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\ssystem v5.1.1 build 3\install default settings.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\ssystem v5.1.1 build 3\ab system spy v5.1.1.lnk (1 KB)
  

For the remote admin component:

• Installer: systemspyserver.exe (513 KB)
  MD5: C4639D14C4D11D828700F926313F88F2
  
• c:\program files\system spy server v1.0\unins000.exe (71 KB)
  
• c:\program files\system spy server v1.0\unins000.dat (2 KB)
  
• c:\program files\system spy server v1.0\tabctl32.ocx* (204 KB)
  
• c:\program files\system spy server v1.0\sss.url (1 KB)
  
• c:\program files\system spy server v1.0\sss.exe (71 KB)
  MD5: FEDF46B101053276CD5CA403F09315CE
  
• c:\program files\system spy server v1.0\sss.chm (18 KB)
  
• c:\program files\system spy server v1.0\mswinsck.ocx* (105 KB)
  
• c:\program files\system spy server v1.0\license.txt (1 KB)
  
• c:\documents and settings\all users\start menu\programs\system spy server v1.0\visit our website.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\system spy server v1.0\uninstall system spy server v1.0.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\system spy server v1.0\system spy server v1.0.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\system spy server v1.0\read user manual.lnk (1 KB)
  
• c:\documents and settings\all users\start menu\programs\system spy server v1.0\license.lnk (1 KB)
  

* Although these files are added as a result of installing this application, they appear by themselves innocent and may already be present on a system and used by other applications. Therefore, they are not included in detection or removal.

Registry

The following registry keys are created:

For the client logging component:

• HKEY_LOCAL_MACHINE\Software\SSystem
  
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  \Uninstall\AB System Spy v5.1.1 build 3_is1
  
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
  "Config"="KsP@WQMRKLs"
  
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
  "System"="Xo=@SMCRPYs"
  
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  "abss"="c:\program files\ssystem v5.1.1 build 3\system.exe"
  
• HKEY_CURRENT_USER\Software\VB and VBA Program Settings\SSystem
  

For the remote admin component:

• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  \Uninstall\System Spy Server v1.0_is1
  
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
  "Config"="KsP@WQMRKLs"
  
• HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup
  "System"="Xo=@SMCRPYs"
  
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
  \MenuOrder\Start Menu\Programs\System Spy Server v1.0
  

Network Impact

The logging component listens on the following network connection(s):

• system.exe 868 (TCP)
  

Additional overhead in bandwidth usage due to upload of logged data and communication with remote auditing tool (if so configured).

Removal

Aliases

Aliases

N/A