Malware Analysis of SPR/KeyLogger.ns.241

Created files:

C:\NeoSpy\options.dat
C:\NeoSpy\ReadMe.txt
C:\NeoSpy\Shr.dll
C:\NeoSpy\SPlayer.ini
C:\NeoSpy\stop.lnk

Autostart registry keys:

HKLM\Software\Classes\zspfile\shell\open\command\: “C:\NeoSpy\main.exe /import “%1″”
HKLM\System\CurrentControlSet\Services\NPF\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\System\CurrentControlSet\Services\NPF\Type: 0x00000001
HKLM\System\CurrentControlSet\Services\NPF\Start: 0x00000003
HKLM\System\CurrentControlSet\Services\NPF\ErrorControl: 0x00000001
HKLM\System\CurrentControlSet\Services\NPF\ImagePath: “system32\drivers\NPF.sys”
HKLM\System\CurrentControlSet\Services\NPF\DisplayName: “WinPcap Packet Driver (NPF)”
HKLM\System\CurrentControlSet\Services\NPF\TimestampMode: 0x00000000
HKLM\System\CurrentControlSet\Services\Winpcap\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 18 00 FF 01 0F 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 00 00 14 00 8D 01 02 00 01 01 00 00 00 00 00 05 0B 00 00 00 00 00 18 00 FD 01 02 00 01 02 00 00 00 00 00 05 20 00 00 00 23 02 00 00 01 01 00 00 00 00 00 05 12 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00
HKLM\System\CurrentControlSet\Services\Winpcap\Type: 0x00000001
HKLM\System\CurrentControlSet\Services\Winpcap\Start: 0x00000003
HKLM\System\CurrentControlSet\Services\Winpcap\ErrorControl: 0x00000001
HKLM\System\CurrentControlSet\Services\Winpcap\ImagePath: “\??\%SysDir%\Drivers\npf.sys”
HKLM\System\CurrentControlSet\Services\Winpcap\DisplayName: “Winpcap”
HKLM\System\CurrentControlSet\Services\Winpcap\TimestampMode: 0x00000000
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs: “C:\NeoSpy\nspl.dll”
HKLM\System\CurrentControlSet\Services\BITS\Start: 0x00000002

Detected by UnHackMe:

SHR.DLL
Default location: C:\NEOSPY\SHR.DLL

Written by NightWatcher

Malware Hunter.
Google+

UnHackMe removes malware invisible for your antivirus!

UnHackMe is compatible with most antivirus software.
UnHackMe is 100% CLEAN, which means it does not contain any form of malware, including adware, spyware, viruses, trojans and backdoors. VirusTotal (0/56).
System Requirements: Windows 2000-Windows 8.1/10. UnHackMe uses minimum of computer resources.