Spyware.KeyboardLogger

Updated: February 13, 2007 11:44:38 AM

Type: Spyware

Version: v1.3

Publisher: PANTERASoft

Risk Impact: High

File Names: keyspy.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.KeyboardLogger is installed it does the following:

Creates the following files:
- %SystemDrive%\Documents and Settings\All Users\Application Data\KLog\ins.dat
- %UserProfile%\Start Menu\Programs\Keyboard Logger Pro\Help.lnk
- %UserProfile%\Start Menu\Programs\Keyboard Logger Pro\Keyboard Logger.lnk
- %UserProfile%\Start Menu\Programs\Keyboard Logger Pro\Order on-line.lnk
- %UserProfile%\Start Menu\Programs\Keyboard Logger Pro\Uninstall.lnk
- %ProgramFiles%\Keyboard Logger\KeySpy.exe (Spyware.Keyboardlogger)
- %ProgramFiles%\Keyboard Logger\kh.dll
- %ProgramFiles%\Keyboard Logger\kl.chm
- %ProgramFiles%\Keyboard Logger\license.txt
- %ProgramFiles%\Keyboard Logger\Order.url
- %ProgramFiles%\Keyboard Logger\Readme.txt
- %ProgramFiles%\Keyboard Logger\Uninstall.exe
  
  Note:
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[Current User] (Windows NT/2000/XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %SystemDrive% is a variable that refers to the drive on which Windows is installed. By default, this is drive C.
Adds the following value:

"pskl" = "%ProgramFiles%\Keyboard Logger Pro\keyspy.exe"to the registry subkey:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts.
Creates the following registry subkeys:

HKEY_CURRENT_USER\Software\Keyboard Logger Pro HKEY_CLASSES_ROOT\{RandomCLSID}

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}