Matewatcher

[Loretta L]

I use AOL as my internet server, and it has a spyware program. Recently it notified me that it found within my computer something called "Mate Watcher". This is something that neither Spybot nor Norton spyware caught, and I couldn't find any info about it in your web site. So, I googled MateWatcher, and found matewatcher.com. Turns out it's a consumer product -- a spyware program that can be bought and installed remotely, obviously without the computer owner's knowledge or permission. It's home page brags that because it's a consumer product, most spyware programs don't catch it. It advertises that it helps a spouse spy on his or her partner, or a parent monitor their child's internet activity. But the bottom line is that it also says the user of MateWatcher can access its hidden file within the computer which stores ALL internet activity, which can even be copied and printed up. Everything can be done remotely, from anywhere, with no physical contact of the computer. I'd love to know how (and from whom) this got on my computer, how to access it and see what is stored, and of course how to remove it. Any info on this? Thanks in advance.

[tashi]

Hello.
It is a commercial keylogger yes.

As to how it got there, did you receive an email from someone you know and click on an attachment just before your spyware program found this on the computer?

No physical access is required. This product's Control Panel software allows you to create small Remote Install monitoring files that you can email and send to the person you want to monitor. The person receives your email and downloads your Remote Install file and then double clicks it. The install file then invisibly in stealth installs itself on that computer, restart it, and begins monitoring that user's activity. You can then use the Control Panel software to remotely view all their activity. Remember you can only use this product to monitor computers you personally own or have been given explicit permission to monitor.

http://www.matewatcher.com/pages/29/index.htm

Let's take a look at the system.

• Open SpyBot, check for and get any updates available.
• Close all browsers, check for problems and fix everything found in red
• Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except
  
• Uncheck[ ] do not report disabled or known legitimate Items.
• uncheck[ ] Include a list of services in report.
• Uncheck[ ] Include uninstall list in report.
  
• Now select (near the top) view report.
• Press export in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach or post that report please.

[tashi]

Loretta L.
Are you using Spybot-S&D version 1.3 or 1.4?

Please open Spybot>Help>About
Let us know the version and latest detection update.

Also what is the Operating System.

• Version 1.4 :Systems Supported

• Spybot-S&D Version 1.4 Download

• Uninstalling Previous Spybot-S&D

• Tutorial

• Solution to fix the pop-ups in TeaTimer.

Re pm, if you take a look around the forums, particularily here:
Malware Forum
People from all over post logs so that they can be assisted.

However you could email the log to:
detections(AT)spybot.info with a link back to this topic.

Cheers.

[KClark]

My aol spyware also just detected MateWatcher. How can I tell how long it's been here and where it came from and what info it has transmitted?

[tashi]

Hi there.
Someone could take a look at the system if you would like.

If so, please go here and follow instructions.
Before you post a log, and who will advise you.

Start a topic here:
Malware Forum

Someone will then take a look and advise you as soon as possible.

Cheers.

[JimHays]

I too had Matewatcher popup on my AOL anti-spyware program. I think a friend of ours (knowingly or not) sent it with some pictures. I chose to block it, but the logfile didn't show it as being blocked. So I did some research and found that PestPatrol was the only program that claimed to get rid of it. I bought a copy of PP and when I came home the next day, Matewatcher was listed in the AOL logs as being blocked. Long story short, it seemed the AOL program did the trick, but I also now have PestPatrol. (And Ad-Aware and of course Spybot! )

Does anyone know if Matewatcher would replicate itself and mail itself out with attachments without the original user knowing? Sneaky bastard of a program!