from the doc: "The original spyware program! NetSpy was around long before most spyware programs of today and still remains the easiest to use and uses less system resources than any other spyware program available on the market! Small, yet powerful! With NetSpy you can secretly see what web sites others are accessing from a PC! NetSpy can also be configured to prevent access to specific web sites and even prevent credit card purchases! NetSpy runs invisibly so the user surfing the internet has no idea that big brother is watching them! Parents, use NetSpy to shield your children from pornographic web sites and prevent them from purchasing items online. Employers, see what web sites your employees are visiting and how much time they are spending surfing the web. NetSpy will also record every key that a user types...even passwords! You can even read their private email messages after they have been deleted!"
netspy keylogger.exeWindowssystem32 config.exeWindowssystem32 sutil.exeWindowssystem32 sys.exe
Windowssystem32kbhook.dll
HKEY_CLASSES_ROOTcapturescreens.capturescreenHKEY_CLASSES_ROOTclsid{5508498f-7911-11d4-92d5-00105a1a0059}HKEY_CLASSES_ROOTclsid{55084990-7911-11d4-92d5-00105a1a0059}HKEY_CLASSES_ROOTclsid{55084991-7911-11d4-92d5-00105a1a0059}HKEY_CLASSES_ROOTclsid{55084995-7911-11d4-92d5-00105a1a0059}HKEY_CLASSES_ROOTinterface{55084990-7911-11d4-92d5-00105a1a0059}HKEY_CLASSES_ROOTinterface{55084995-7911-11d4-92d5-00105a1a0059}HKEY_CLASSES_ROOT ypelib{5508498f-7911-11d4-92d5-00105a1a0059}HKEY_LOCAL_MACHINEhardwareesourcemappnp managerpnpmanagerdevice 05358.rawHKEY_LOCAL_MACHINEhardwareesourcemappnp managerpnpmanagerdevice 05358.translatedHKEY_LOCAL_MACHINEsoftwareclassescapturescreens.capturescreenHKEY_LOCAL_MACHINEsoftwareclassesclsid{55084991-7911-11d4-92d5-00105a1a0059}HKEY_LOCAL_MACHINEsoftwareclassesinterface{55084990-7911-11d4-92d5-00105a1a0059}HKEY_LOCAL_MACHINEsoftwareclassesinterface{55084995-7911-11d4-92d5-00105a1a0059}HKEY_LOCAL_MACHINEsoftwareclasses ypelib{5508498f-7911-11d4-92d5-00105a1a0059}HKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionapp paths sys.exeHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshareddllsc:winntsystem32kbhook.dllHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshareddllsc:winntsystem32 config.exeHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionshareddllsc:winntsystem32 sutil.exeHKEY_LOCAL_MACHINEsoftware etspyautoeraseHKEY_LOCAL_MACHINEsoftware etspyautorunHKEY_LOCAL_MACHINEsoftware etspyduplicatesHKEY_LOCAL_MACHINEsoftware etspyfileHKEY_LOCAL_MACHINEsoftware etspyintervalHKEY_LOCAL_MACHINEsoftware etspykeylogHKEY_LOCAL_MACHINEsoftware etspykeymaxHKEY_LOCAL_MACHINEsoftware etspymaxscreensHKEY_LOCAL_MACHINEsoftware etspymenuHKEY_LOCAL_MACHINEsoftware etspy ewfileHKEY_LOCAL_MACHINEsoftware etspy ewkfileHKEY_LOCAL_MACHINEsoftware etspypathHKEY_LOCAL_MACHINEsoftware etspypwdHKEY_LOCAL_MACHINEsoftware etspyscrintervalHKEY_LOCAL_MACHINEsoftware etspyscrsaveHKEY_LOCAL_MACHINEsoftware etspyspkeyHKEY_LOCAL_MACHINEsoftware etspysplashHKEY_LOCAL_MACHINEsoftware etspyurlmaxHKEY_LOCAL_MACHINEsoftware etspyusernameHKEY_LOCAL_MACHINEsoftwares7000string1