Spyware.EasyKeyLogger

Printer Friendly Page

Updated: February 13, 2007 11:43:24 AM

Type: Spyware

Version: 1.0

Publisher: SOFTSAGA Corporation

Risk Impact: High

File Names: Epl.exe EPLAgent.dll EKLSetup.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Spyware.EasyKeyLogger is executed, it performs the following actions:

Creates the following files:
- %ProgramFiles%\Easy Keyboard Logger\epl.exe
- %ProgramFiles%\Easy Keyboard Logger\epl.url
- %ProgramFiles%\Easy Keyboard Logger\EPLAgent.dll
- %ProgramFiles%\Easy Keyboard Logger\help.htm
- %ProgramFiles%\Easy Keyboard Logger\License.txt
- %ProgramFiles%\Easy Keyboard Logger\ReadMe.txt
- %ProgramFiles%\Easy Keyboard Logger\unins000.dat
- %ProgramFiles%\Easy Keyboard Logger\unins000.exe
- %UserProfiles%\Start Menu\Programs\Easy Keyboard Logger\Easy Keyboard Logger on the Web.lnk
- %UserProfiles%\Start Menu\Programs\Easy Keyboard Logger\Easy Keyboard Logger.lnk
- %UserProfiles%\Start Menu\Programs\Easy Keyboard Logger\Uninstall Easy Keyboard Logger.lnk
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Easy Keyboard Logger.lnk
- %UserProfile%\Desktop\Easy Keyboard Logger.lnk
- %UserProfile%\Local Settings\Temp\EasyKeylog.txt
  
  Notes:
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
Adds the value:

"EasyKeyboardLogger" = "%ProgramFiles%\Easy Keyboard Logger\epl.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the Spyware.EasyKeyLogger runs every time Windows starts.
Creates the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Easy Keyboard Logger_is1 HKEY_LOCAL_MACHINE\SOFTWARE\SOFTSAGA Easy Keyboard Logger HKEY_CURRENT_USER\Software\EKL
Logs all keystrokes, including passwords.
Can be configured to run in stealth mode, which makes it difficult to detect its presence.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}