Spyware.SpyKeylogger

Printer Friendly Page

Updated: February 13, 2007 11:43:56 AM

Type: Spyware

Version: 1.30

Publisher: Spy-Key-Logger.com

Risk Impact: Medium

File Names: SpyKeylogger-install.exe kl.dll skl.dll skl.exe sklc.dll skls.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.SpyKeylogger is installed, it performs the following actions:

Creates the following files:
- %UserProfile%\Start Menu\Programs\Spy-Keylogger\Help for Spy-Keylogger.lnk
- %UserProfile%\Start Menu\Programs\Spy-Keylogger\License.lnk
- %UserProfile%\Start Menu\Programs\Spy-Keylogger\Readme.lnk
- %UserProfile%\Start Menu\Programs\Spy-Keylogger\Spy-Keylogger.lnk
- %UserProfile%\Start Menu\Programs\Spy-Keylogger\Uninstall Spy-Keylogger.lnk
- %ProgramFiles%\SpyKeyLogger\kl.dll
- %ProgramFiles%\SpyKeyLogger\license.txt
- %ProgramFiles%\SpyKeyLogger\readme.txt
- %ProgramFiles%\SpyKeyLogger\skl.chm
- %ProgramFiles%\SpyKeyLogger\skl.dll
- %ProgramFiles%\SpyKeyLogger\skl.exe
- %ProgramFiles%\SpyKeyLogger\skl.ini
- %ProgramFiles%\SpyKeyLogger\sklc.dll
- %ProgramFiles%\SpyKeyLogger\skls.exe
- %ProgramFiles%\SpyKeyLogger\Uninstall.exe
  
  Notes:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Creates the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\••8•9••••-••••-••••-••3•-11••••18••••• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\skl.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spy-Keylogger HKEY_LOCAL_MACHINE\SOFTWARE\Spy-Keylogger HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SPYKEYLOGGERSERVICE HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\SpyKeyloggerService HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SpyKeyloggerService HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPYKEYLOGGERSERVICE HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SpyKeyloggerService HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SpyKeyloggerService
Adds the value:

"Spy-Keylogger" = "%ProgramFiles%\SpyKeyLogger\skl.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts.
Adds the value:

"Sources" = "SpyKeyloggerService"

in the registry subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\ApplicationHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Sources
Records keystrokes.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}