Spyware.ActiveKeylog

Printer Friendly Page

Updated: February 13, 2007 11:34:53 AM

Type: Spyware

Publisher: Winsoul Software, Inc.

Risk Impact: High

File Names: sys32win.exe akl.exe akl.dll Active Key Logger.exe

Systems Affected: Windows 2000, Windows 3.x, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.ActiveKeylog is executed, it performs the following actions:

Adds the value:

"sys32sql" = "[INSTALLATION PATH]\sys32win.exe"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runso that the spyware runs when Windows starts.

Note:
- This risk may be installed through an installer, but the installation path is configurable. The variable [INSTALLATION PATH] refers to the path that is determined when the risk is installed, and the default value C:\Program Files\Active Key Logger.
- The spyware may be configured to run in stealth mode, hiding its user interface and system tray icon.
Creates the following files:
- %UserProfile%\Desktop\Active Key Logger.lnk
- %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger License Agreement.lnk
- %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger.lnk
- %UserProfile%\Start Menu\Programs\Active Key Logger\Uninstall Active Key Logger.lnk
- %UserProfile%\Start Menu\Programs\Active Key Logger\Visit the Official Active Key Logger Website.lnk
- %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger on the Web.lnk
- %ProgramFiles%\Active Key Logger\Active Key Logger.exe
- %ProgramFiles%\Active Key Logger\Active Key Logger.chm
- %ProgramFiles%\Active Key Logger\CMD16.dll
- %ProgramFiles%\Active Key Logger\License.txt
- %ProgramFiles%\Active Key Logger\Readme.txt2
- %ProgramFiles%\Active Key Logger\smode.dll
- %ProgramFiles%\Active Key Logger\Uninstall.exe1
- %ProgramFiles%\Active Key Logger\Visit the Official Active Key Logger Website.url
- %ProgramFiles%\Active Key Logger\akl.dll
- %ProgramFiles%\Active Key Logger\AKL.url
- %ProgramFiles%\Active Key Logger\order.txt
- %ProgramFiles%\Active Key Logger\unins000.dat
- %ProgramFiles%\Active Key Logger\unins000.exe
  
  Note:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Creates the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Uninstall\Active Key Logger HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Uninstall\Active Key Loggerr HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Uninstall\Active Key Logger_is1 HKEY_LOCAL_MACHINE\SOFTWARE\winsoul
Records keystrokes and may send recorded information to a predefined email address.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}