Spytrooper is a fake anti-spyware program that warns users of non-existing threats, in order to trick them into buying the full version and registering the program. Spytrooper is automatically downloaded and installs several adult sites or pirated software websites that use vulnerability exploits in order to affect computers.
spytrooper.exeuninstall.exeinstalls66.exeinstall655.exeinstall365.exeinstall36.exeinstall266.exeinstall265.exeinstall26.exeinstall166.exeinstall066.exeinstall.exeinstal2664.exe0000661.exe
procmon.dlliesecurity.dllheur003.dllheur002.dllheur001.dllheur000.dll
HKEY_CURRENT_USERSoftwareSNO2HKEY_CURRENT_USERSoftwareSpyTrooperHKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallSpyTrooperHKEY_CURRENT_USERsoftwarespytrooperplaysoundsHKEY_CURRENT_USERsoftwarespytrooperscanonstartupHKEY_CURRENT_USERsoftwarespytrooperscheduledscanHKEY_CURRENT_USERsoftwarespytrooperscheduledscanhourHKEY_CURRENT_USERsoftwarespytrooperscheduledscanminHKEY_CURRENT_USERsoftwarespytroopersecurityHKEY_CURRENT_USERsoftwarespytroopersecuritylevelHKEY_CURRENT_USERsoftwarespytrooperuninstallHKEY_CURRENT_USERsoftwarespytrooperiesecurityblockiframetagsHKEY_CURRENT_USERsoftwarespytrooperiesecurityblockjavascriptsHKEY_CURRENT_USERsoftwarespytrooperiesecurityblocklocationsHKEY_CURRENT_USERsoftwarespytrooperiesecurityblockpopupwindowsHKEY_CURRENT_USERsoftwarespytrooperiesecurityblocktagsHKEY_CURRENT_USERsoftwarespytrooperiesecurityprotecthomepageHKEY_CURRENT_USERsoftwarespytrooperprocesssecuritypoliciesactivepolicyHKEY_CURRENT_USERsoftwarespytrooperprocesssecuritypoliciesprocesssecurityHKEY_CURRENT_USERsoftwarespytrooperprocesssecuritypoliciesallowedc:programfilesspytrooperspytrooper.exeHKEY_CURRENT_USERsoftwarespytrooperscandeletefoundthreatsHKEY_CURRENT_USERsoftwarespytroopersystemsecurityprotectactivedesktopHKEY_CURRENT_USERsoftwarespytroopersystemsecurityprotectautorunHKEY_CURRENT_USERsoftwarespytroopersystemsecurityprotecthostsHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallspytrooperdisplayiconHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallspytrooperdisplaynameHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallspytrooperhelplinkHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallspytrooperuninstallstringHKEY_LOCAL_MACHINEsoftwaremicrosoftwindowscurrentversionuninstallspytrooperurlinfoabout