Spyware.Wintective

[Brad]

Behavior
Spyware.Wintective logs keystrokes, captures screenshots, and monitors Internet activity. The gathered information can be sent to a predetermined email address.

Symptoms
Your Symantec program detects Spyware.Wintective.

Transmission
Spyware.Wintective must be manually installed.

technical details
File names:
wintective.exe

When Spyware.Wintective is installed, it performs the following actions:

   1. Creates the following files:

          * %ProgramFiles%\wintective\logs\key_log.htm
          * %ProgramFiles%\wintective\logs\url_log.htm
          * %ProgramFiles%\wintective\ST6UNST.LOG
          * %ProgramFiles%\wintective\wintective.dat
          * %ProgramFiles%\wintective\wintective.exe
          * %System%\MSVBVM60.DLL
          * %System%\mswinsck.ocx
          * %System%\VB6STKIT.DLL
          * %System%\wintective.dll
          * %Windir%\IE4 Error Log.txt
          * %Windir%\Setup1.exe
          * %Windir%\ST6UNST.EXE

            Notes:
          * %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
          * %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt (Windows NT/2000).
          * %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

   2. Creates the following registry subkeys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A1C811C-88FF-493B-98A9-83B4A649ACD9}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BB81FA79-DCD7-48A6-A710-A85BD5ED9640}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C2A3FF36-C3A5-4334-968C-1DEA85AAA772}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{57506911-EDA2-4815-810B-7C55A685DA51}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5FB91338-D8D6-4431-B490-8388D37AFE96}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A24154AB-E52F-4F9F-91A0-4E3E243BEDBE}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A34B63B9-8FD8-4004-BED1-4E6E587B5175}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{AA987BF8-E849-4996-9335-413DF4A8158A}
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OSSMTP.Attachment
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OSSMTP.CustomHeader
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\OSSMTP.SMTPSession
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wintective.exe
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #1

   3. Adds the value:

      "wintective" = "%ProgramFiles%\wintective\wintective.exe"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

      so that the risk runs every time Windows starts.

   4. Adds the following values:

      "ApplicationName" = "wintective.exe"
      "DisplayName" = "Wintective KeyLogger and ScreenShot Capture"
      "UninstallString" = "C:\WINDOWS\st6unst.exe -n "C:\Program Files\wintective\ST6UNST.LOG"  "
      "AppToUninstall" = "wintective.exe"

      to the registry subkey:

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ST6UNST #1

   5. Modifies the value:

      "(Default)" = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"

      in the following registry subkeys:

      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B1-713E-11CF-8AE5-00AA00C00905}\TypeLib
      HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\TypeLib

   6. Logs keystrokes, captures screenshots, and monitors Internet activity.

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/spyware.wintective.html