1. /
  2. Security Response/
  3. Spyware.ActiveKeylog

Spyware.ActiveKeylog

Updated:
February 13, 2007 11:34:53 AM
Type:
Spyware
Publisher:
Winsoul Software, Inc.
Risk Impact:
High
File Names:
sys32win.exe akl.exe akl.dll Active Key Logger.exe
Systems Affected:
Windows 2000, Windows 3.x, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.ActiveKeylog is executed, it performs the following actions:
  1. Adds the value:

    "sys32sql" = "[INSTALLATION PATH]\sys32win.exe"

    to the registry key:

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    so that the spyware runs when Windows starts.

    Note:
    • This risk may be installed through an installer, but the installation path is configurable. The variable [INSTALLATION PATH] refers to the path that is determined when the risk is installed, and the default value C:\Program Files\Active Key Logger.
    • The spyware may be configured to run in stealth mode, hiding its user interface and system tray icon.

  2. Creates the following files:

    • %UserProfile%\Desktop\Active Key Logger.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger License Agreement.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Uninstall Active Key Logger.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Visit the Official Active Key Logger Website.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger on the Web.lnk
    • %ProgramFiles%\Active Key Logger\Active Key Logger.exe
    • %ProgramFiles%\Active Key Logger\Active Key Logger.chm
    • %ProgramFiles%\Active Key Logger\CMD16.dll
    • %ProgramFiles%\Active Key Logger\License.txt
    • %ProgramFiles%\Active Key Logger\Readme.txt2
    • %ProgramFiles%\Active Key Logger\smode.dll
    • %ProgramFiles%\Active Key Logger\Uninstall.exe1
    • %ProgramFiles%\Active Key Logger\Visit the Official Active Key Logger Website.url
    • %ProgramFiles%\Active Key Logger\akl.dll
    • %ProgramFiles%\Active Key Logger\AKL.url
    • %ProgramFiles%\Active Key Logger\order.txt
    • %ProgramFiles%\Active Key Logger\unins000.dat
    • %ProgramFiles%\Active Key Logger\unins000.exe

      Note:
    • %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.

  3. Creates the following registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\Active Key Logger
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\Active Key Loggerr
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
    \Uninstall\Active Key Logger_is1
    HKEY_LOCAL_MACHINE\SOFTWARE\winsoul


  4. Records keystrokes and may send recorded information to a predefined email address.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver