PersonalAntispy Description

PersonalAntispy or Personal Anti Spy, is a rogue anti-spyware program often installed by a Trojan through browser security holes. The user may have also downloaded PersonalAntispy’s trial version from a rogue website thinking it would remove his/her spyware infections. Once installed, the user may receive numerous popups from known websites stating that the user’s computer is infested with a large amount of spyware. If the user is tricked into clicking on this popup, he/she will be immediately redirected to PersonalAntispy’s website or other malicious websites (such as antispy.biz and personalantispy.com) for an “online scan”.

Once PersonalAntispy emulates its computer system scan, it will generate a list of supposed spyware infections found in the user’s computer system. These results are totally bogus, they are only meant to urge you to purchase PersonalAntispy’s full version to remove the imaginary threats. PersonalAntispy may cause computer slowdowns.

Type: Spyware

Automatic Detection of PersonalAntispy

PersonalAntispy Technical Report

As new PersonalAntispy details are reported by our customers and findings from our Threat Research Center, we will update this section.

The following PersonalAntispy files with its MD5s were created in the system:

PersonalAntispy has typically the following processes in memory:

• personalantispy_ifree[1].exe
• c:\Program Files\PersonalAntiSpy Free\AsAgents.dll
• c:\Program Files\PersonalAntiSpy Free\msvcr71.dll
• c:\Program Files\PersonalAntiSpy Free\unins000.exe
• c:\Program Files\PersonalAntiSpy Free\shellext.dll
• c:\Program Files\Common Files\PersonalAntiSpy\pbm.exe
• c:\WINDOWS\system32\gdiplus.dll
• pbm.exe
• PersonalAntiSpy_Setup_Dual_en.exe
• uwasfsd.sys
• PersonalAntiSpySetup.exe
• c:\Program Files\PersonalAntiSpy Free\InstHelp.exe
• c:\Program Files\PersonalAntiSpy Free\msvcp71.dll
• c:\Program Files\PersonalAntiSpy Free\upascw.exe
• c:\Program Files\PersonalAntiSpy Free\uwasffNT.exe
• c:\WINDOWS\system32\atl71.dll
• c:\WINDOWS\system32\drivers\uwasfsd.sys
• PersonalAntiSpy_Installer_Dual_en[1].exe
• personalantispy_free[1].exe
• upascw.exe
• c:\Program Files\PersonalAntiSpy Free\atl71.dll
• c:\Program Files\PersonalAntiSpy Free\mfc71.dll
• c:\Program Files\PersonalAntiSpy Free\pas.exe
• c:\Program Files\PersonalAntiSpy Free\UserAgent.dll
• c:\WINDOWS\system32\mfc71.dll
• c:\WINDOWS\system32\msvcp71.dll
• PersonalAntiSpy_Installer_Dual_en.exe

PersonalAntispy created the following directories, files, paths:

• %ProgramFiles%\PersonalAntiSpy Free
• %AppData%\PersonalAntiSpy
• %AllUsersProfile%\Application Data\PersonalAntiSpy
• %AllUsersProfile%\Start Menu\Programs\PersonalAntiSpy
• %CommonProgramFiles%\PersonalAntiSpy

PersonalAntispy creates the following registry entries:

• *\shellex\ContextMenuHandlers\ExplorerUPAS
• upashellext.ShellHook.1
• HKEY_CURRENT_USER\Software\PersonalAntiSpy Free
• HKEY_CLASSES_ROOT\Drive\shellex\ContextMenuHandlers\ExplorerUPAS
• HKEY_CLASSES_ROOT\Interface\{4567AB12-A884-4CA6-B739-CEDB12FEF096}
• HKEY_CLASSES_ROOT\TypeLib\{4567AB12-AE24-4FD6-B479-E2B464F32DA6}
• HKEY_CLASSES_ROOT\upashellext.WASContextMenu.1
• HKEY_CLASSES_ROOT\uwasfsd.CreationNotifier
• HKEY_CLASSES_ROOT\CLSID\{1924FA29-9740-4F6B-A683-90FB42FC1237}
• HKEY_CLASSES_ROOT\CLSID\{ABCD4567-76B5-4bc7-AAC5-396D70925B11}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “PersonalAntiSpy Free”
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform “UPAS 3.2.155.0″
• 5CAB6A79-7710-405a-9B08-A13E908534E9
• PersonalAntiSpy Free
• upashellext.ShellHook
• upashellext.WASContextMenu.1
• HKEY_LOCAL_MACHINE\SOFTWARE\PersonalAntiSpy Free
• HKEY_CLASSES_ROOT\Interface\{ABCD4567-D8E8-4DF1-A3EA-D0AA72F42611}
• HKEY_CLASSES_ROOT\TypeLib\{C766ED4F-EF37-4C77-8F71-288661A2D513}
• HKEY_CLASSES_ROOT\upashellext.WASContextMenu
• HKEY_CLASSES_ROOT\upashellext.ShellHook.1
• HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ExplorerUPAS
• HKEY_CLASSES_ROOT\CLSID\{5CAB6A79-7710-405a-9B08-A13E908534E9}
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uwasfsd
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “upascw”
• Directory\shellex\ContextMenuHandlers\ExplorerUPAS
• PersonalAntiSpy
• SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\1924FA29-9740-4F6B-A683-90FB42FC1237
• C766ED4F-EF37-4C77-8F71-288661A2D513
• upashellext.WASContextMenu
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PersonalAntiSpy Free_is1
• HKEY_CLASSES_ROOT\Directory\shellex\ContextMenuHandlers\ExplorerUPAS
• HKEY_CLASSES_ROOT\Interface\{ABCD4567-4D73-43E9-85E5-53A2DBD95411}
• HKEY_CLASSES_ROOT\TypeLib\{ABCD4567-7437-43EF-AB74-4AB1D3A37411}
• HKEY_CLASSES_ROOT\upashellext.ShellHook
• HKEY_CLASSES_ROOT\uwasfsd.CreationNotifier.1
• HKEY_CLASSES_ROOT\CLSID\{_CLSID_WAShellExecuteCheck}
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\uwasfsd
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run “PASMonitor”
• Drive\shellex\ContextMenuHandlers\ExplorerUPAS
• 1924FA29-9740-4F6B-A683-90FB42FC1237

Important Article Disclaimer