Spyware.SherlockKeylog

[Brad]

Behavior
Spyware.SherlockKeylog is a spyware program that logs keystrokes.

Symptoms
The files are detected as Spyware.SherlockKeylog.

Transmission
Spyware.SherlockKeylog must be manually installed.

technical details
File names:
SherlockConfiguration.exe
Sherlock.exe

When Spyware.SherlockKeylog is installed, it performs the following actions:


   1. Creates the following files:

          * %UserProfile%\Start Menu\Programs\Sherlock Configuration\Sherlock Configuration.LNK
          * %ProgramFiles%\Sherlock Configuration\SherlockConfiguration.exe
          * %ProgramFiles%\Sherlock Configuration\ST6UNST.LOG
          * %Windir%\Setup1.exe
          * %Windir%\ST6UNST.EXE
          * %System%\AAMD532.DLL
          * %System%\Sherlock.exe
          * %System%\VB6STKIT.DLL

            Notes:
          * %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
          * %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
          * %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
          * %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

   2. Creates the following registry subkeys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SherlockConfiguration.exe
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #1

   3. Adds the following values:

      "C:\WINDOWS\system32\COMCAT.DLL" = "2"
      "C:\WINDOWS\system32\stdole2.tlb" = "2"
      "C:\WINDOWS\system32\asycfilt.dll" = "0"
      "C:\WINDOWS\system32\olepro32.dll" = "0"
      "C:\WINDOWS\system32\oleaut32.dll" = "0"
      "C:\WINDOWS\System32\scrrun.dll" = "2"
      "C:\WINDOWS\System32\Sherlock.exe" = "0"
      "C:\WINDOWS\system32\VB6STKIT.DLL" = "0"
      "C:\WINDOWS\System32\AAMD532.DLL" = "1"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs

   4. Modifies the value:

      "(Default)" = "{420B2830-E718-11CF-893D-00A0C9054228}"

      in the registry subkeys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0AB5A3D0-E5B6-11D0-ABF5-00A0C90FFFC0}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2A0B9D10-4B87-11D3-A97A-00104B365C9F}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{53BAD8C1-E718-11CF-893D-00A0C9054228}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7C3F5A0-88A3-11D0-ABCB-00A0C90FFFC0}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7C3F5A1-88A3-11D0-ABCB-00A0C90FFFC0}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7C3F5A2-88A3-11D0-ABCB-00A0C90FFFC0}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7C3F5A3-88A3-11D0-ABCB-00A0C90FFFC0}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7C3F5A4-88A3-11D0-ABCB-00A0C90FFFC0}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C7C3F5A5-88A3-11D0-ABCB-00A0C90FFFC0}\TypeLib

   5. Logs keystrokes.

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/spyware.sherlockkeylog.html