1. /
  2. Security Response/
  3. Spyware.SpyKeylogger

Spyware.SpyKeylogger

Updated:
February 13, 2007 11:43:56 AM
Type:
Spyware
Version:
1.30
Publisher:
Spy-Key-Logger.com
Risk Impact:
Medium
File Names:
SpyKeylogger-install.exe kl.dll skl.dll skl.exe sklc.dll skls.exe
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.SpyKeylogger is installed, it performs the following actions:

  1. Creates the following files:

    • %UserProfile%\Start Menu\Programs\Spy-Keylogger\Help for Spy-Keylogger.lnk
    • %UserProfile%\Start Menu\Programs\Spy-Keylogger\License.lnk
    • %UserProfile%\Start Menu\Programs\Spy-Keylogger\Readme.lnk
    • %UserProfile%\Start Menu\Programs\Spy-Keylogger\Spy-Keylogger.lnk
    • %UserProfile%\Start Menu\Programs\Spy-Keylogger\Uninstall Spy-Keylogger.lnk
    • %ProgramFiles%\SpyKeyLogger\kl.dll
    • %ProgramFiles%\SpyKeyLogger\license.txt
    • %ProgramFiles%\SpyKeyLogger\readme.txt
    • %ProgramFiles%\SpyKeyLogger\skl.chm
    • %ProgramFiles%\SpyKeyLogger\skl.dll
    • %ProgramFiles%\SpyKeyLogger\skl.exe
    • %ProgramFiles%\SpyKeyLogger\skl.ini
    • %ProgramFiles%\SpyKeyLogger\sklc.dll
    • %ProgramFiles%\SpyKeyLogger\skls.exe
    • %ProgramFiles%\SpyKeyLogger\Uninstall.exe

      Notes:
    • %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.

  2. Creates the following registry subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\••8•9••••-••••-••••-••3•-11••••18•••••
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\skl.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spy-Keylogger
    HKEY_LOCAL_MACHINE\SOFTWARE\Spy-Keylogger
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SPYKEYLOGGERSERVICE
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\SpyKeyloggerService
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SpyKeyloggerService
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPYKEYLOGGERSERVICE
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SpyKeyloggerService
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SpyKeyloggerService


  3. Adds the value:

    "Spy-Keylogger" = "%ProgramFiles%\SpyKeyLogger\skl.exe"

    to the registry subkey:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    so that the risk runs every time Windows starts.

  4. Adds the value:

    "Sources" = "SpyKeyloggerService"

    in the registry subkeys:

    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Sources

  5. Records keystrokes.


Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report, Volume 17
Symantec DeepSight Screensaver