McAfee > Theat Center > PUP Detail Page

Characteristics

McAfee Labs recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application.  If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software.
Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Summary:

Upon execution Spyware-PowerSpy:

1. Creates the following files and folders:

 %Program Files%\SCPP\COMCTL32.OCX
 %Program Files%\SCPP\comdlg32.OCX
 %Program Files%\SCPP\help.chm
 %Program Files%\SCPP\load.exe
 %Program Files%\SCPP\mscomct2.ocx
 %Program Files%\SCPP\nvhostv.exe
 %Program Files%\SCPP\ps_demo_report.html
 %Program Files%\SCPP\pssetup.exe
 %Program Files%\SCPP\symserv.exe
 %Program Files%\SCPP\testftpok.html
 %Program Files%\SCPP\tmphost.exe
 %Program Files%\SCPP\unins000.dat
 %Program Files%\SCPP\unins000.exe
 %Program Files%\SCPP\ico\
 %system%\accSvcHst.exe
 %system%\gdiplus.dll
 %system%\wnaspid.exe
 %system%\mxpvct22.dat
 %system%\mxpvct23.dat
 %system%\mxpvct25.dat

2. Modifies the Windows Registry:

Adds the value:

"wnaspid"=C:\WINDOWS\system32\wnaspid.exe

to the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

which causes the application to run at every system startup.

Spyware-PowerSpy provides the user with a graphical interface to configure which system components and applications to monitor:

Configuration includes the default capability to operate in a stealth mode making the application and its behavior effectively invisible to any user of the system:

Removal

Aliases

Aliases

N/A