|
Spector removal
| Spyware Spector Information |
Name: Spector
Category: Keylogger
Date: 2004-02-27
Dangerous: Yes
|
Spector is Keylogger which is malware.
Key Logger. Runs silently, logs screenshots. Contains some code used in the Ghost Key logger. Installing it is highly not recommended.
Spector description by publisher:
Creator: ´Spector Pro 3.1 offers a great variety of features. Users of Spector 2.x should feel right at home with this version of Spector. New users will find that Spector´s innovative person interface provides excellent ease of use while still yielding its full power. Here´s a comprehensive list of features in Spector Pro 3.1: Spector 3.1 monitors the following types of information: Snapshots, Email, Typed-in key sequences, IM/Chat, & Internet domains accessed. Snapshots: Spector Pro can periodically record the computer screen. With these Snapshots, you can actually see everything that occurs on the PC. These Snapshots can be stealn up to every 2nd, & you can record them in varying levels of quality. For the best compression ratios (less disk space), choose a color mode that offers less colors. These settings made to be found by pressing the "Settings" button when viewing Snapshots. NOTE: If you´re using Windows NT or Windows 2000, you should choose at least 8-bit color for optimal performance. For all other Windows platforms the default recording mode of 4-bit grayscale provides the best quality with the least required storage space. Email: Spector Pro has the ability to capture the actual emails that are received and sent from a computer. Simply click the "Email" button to see all the captured emails. Currently, Spector Pro logs SMTP/POP3 Internet mail (Outlook-style mail), AOL email for version 5.0 & above, & web mail that´s read via an internet browser. Spector Pro currently supports the recording of the web mail sent & received via Hotmail, Yahoo, AOL.com, & Netscape.com. The email viewer inside Spector Pro works much like Outlook or AOL´s mail system. You can view mail, delete mail, & you can even Forward mail to another user. Spector Pro 3.1 currently support recording of email attachments for SMTP/POP3 email (Outlook). File attachments to AOL, Hotmail, & Yahoo email can NOT be recorded with Spector Pro 3.1. Spector Pro can NOT yet record corporate mail platforms like MS Exchange or Lotus Notes. Typed-in key sequences: Spector Pro logs all the actual typed-in key sequences typed on the PC. To view all the typed-in key sequences, simply click the "Typed-in key sequences" button. This view is broken down by each program. For example, if you wanted to see all the typed-in key sequences typed in Outlook, just double-click the Outlook entry. When viewing the typed-in key sequences, you can choose to see all the typed-in key sequences, including extended characters such as Ctrl & Alt by selecting View>Detailed, or a formatted view by selecting View>Text. When you´re viewing Snapshots, you also have the ability to go to the typed-in key sequences associated with the screenshot by right-clicking & choosing "Goto Typed-in key sequences." This is useful for viewing the typed-in key sequences that are typed, but are not displayed on the screen, as with "*******" that´s displayed when a password is typed. IM/Chat: Spector Pro has the ability to capture Instant Messaging & Chat in the following applications: AOL Chat, AOL Instant Messanger (AIM), MSN Messenger, Yahoo! Messenger, & ICQ. Please note that this feature will only work on the stand-alone versions of these software packages, & Spector Pro will be unable to capture both sides of a Chat conversation that steals place in a web browser using Java such as MS Internet Explorer. You´ll, of course, still have the Snapshots for web-based Chat conversations. To view IM/Chat conversations, simply click the "IM/Chat" button. Internet URLs: Spector Pro logs all the URL domains (internet addresses) that were accessed while Spector Pro was recording. To view these URLs, simply choose "Internet" from the small drop-down box above the Snapshots. The big drop-down box will then contain all the domain addresses in the time sequence they were accessed. You can choose an internet address & jump to the snapshots that was associated with the selected domain. You may need to navigate forward or backward a few snapshots to find the snapshot of the domain that was visited. Alert System: Spector Pro 3.1 has a very extensive & powerful "alert" system. These alerts are based upon keywords that you supply in the "Settings" dialog box under the "Alerts" tab. Once you´ve inputed in keywords, Spector Pro will constantly scan the system for these keywords. For example, if you´ve applicationmed Spector Pro to search for the word "pornography", Spector Pro will scan vigorously for this word, & steal appropriate action if it´s found. Currently, Spector Pro scans all typed-in key sequences, all supported email types, all supported IM/Chat conversations, & all web pages for these keywords. Once a keyword is found, Spector Pro will steal the action that you´ve configured in the Alert Settings. Currently, your options are to have an email notification sent to you about the keyword, & to increase the snapshot rate for a specified time. If you choose to have an email sent to you, all you need to do is enter your email address in the appropriate box. The email alert will contain the word that was found, the time it was found, as well as a more extensive context for which the keyword was found. For example, if a keyword was found in an email message, it´ll include the email message itself. The other option you´ve is to increase the snapshot rate for a specified period of time. For example, if the current snapshot rate is one snapshot per 30 2nds, you can tell Spector Pro Pro to increase this rate to every 3 2nds for the next 60 2nds. This will allow you to gauge what sort of activity followed the keyword detection. When you´re viewing Snapshots, you also have the ability to jump directly to a screen recording where a keyword was detected. To do this, simply click the small drop-down box marked "Keywords." You´ll then see all the keywords that have been found (if any), & you can select the keyword that interests you. Spector Pro will then automatically steal you to the snapshot that relates to the keyword.
This Keylogger is also known as:
•->\_INST32I.EX_ - named by F-Prot.
>> Delete Spector automatically - Download Spyware Doctor
| Spector Removal Instructions |
|
Kill the following processes
sp40setup.exe, spadmin.exe, spector_eval.exe, spsetup.exe, winnetcl.exe, webebot.exe, wswinntfp.exe
|
|
Unregister the following DLLs and reboot
abfrnex.dll, msurlbot.dll.
netknl.dll, netknlhm.dll in Windows\system32\
|
|
Delete these registry entries
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\menuorder\start menu2\programs\spector
|
|
Remove the following files
042a33f567984d186ddba30456a016ddf5e68b84.tpr, 0f98d24d9648def3b38d5f766841822509770d28.tpr, 1cecf3e5bf3e36907b643293feea2c83c70ef3b5.tpr, 599ca53a.tmp, 5af1ce00169d9ea612fb8718dbb9f8e4ea2896a3.tpr, 5b7640a2561749d083ac1d6384b686ba53782976.tpr, 6daeb37673b204b08433a31d08583d9e7ac5f836.tpr, 881da32609ba94eb22ef88389f53be62bcd3b888.tpr, 8b2831b2489b67ffdd2d3e6490b1498b42b7c514.tpr, abfrnex.dll, b45992e68b3e5aa52fa826db0234dac3a5c212ff.tpr, cim.rec, cim.rep, d07372a7fcd97b6a951eefb66d8562ef08930d33.tpr, e7061190bc88ad0a991ad83352d9e3943a16b572.tpr, e8e9ddfdf18970ada7fbac5af07cbd5bae692635.tpr, fe096d751bfaa71c505c607dd89091d4288f1a89.tpr, logfile.cip, msocxusys.ocx, msurlbot.dll, netknl.1, netknlhm.1, new.reg, ntmsdata.bak, ntmsidx, schedlgu.txt, sp40setup.exe, spadmin.chm, spadmin.exe, speceval.reg, spectorsoft purchase.txt, spector_eval.exe, spsetup.exe, webebot.exe, winmgmt.log, wswinntfp.cnt, wswinntfp.exe, wswinntfp.hlp, _msfilea13.cmp.
spector.lnk in Program Files\Common Files\spector\
netknl.dll, netknlhm.dll, winnetcl.cnt, winnetcl.exe, winnetcl.hlp in Windows\system32\
|
Bookmark Spector page
| Previous Spyware: Remove SpEcTeR NeBuLa |
Next Spyware: Remove Spector 3.1 |
|