Spyware.EliteKeylogger

Printer Friendly Page

Updated: February 13, 2007 11:45:44 AM

Type: Spyware

Version: 2.1

Publisher: WideStep

Risk Impact: High

File Names: ek_setup.exe windump.exe

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP

When Spyware.EliteKeylogger is installed, it does the following:

Creates the following files:
- %ProgramFiles%\WideStep Software\Elite KeyLogger\Logs view.exe
- %ProgramFiles%\WideStep Software\Elite KeyLogger\Uninstall.exe
- %ProgramFiles%\WideStep Software\Elite KeyLogger\mciole.dll
- %UserProfile%\Start Menu\Programs\WideStep Elite KeyLogger 2.6\Uninstall.lnk
- %UserProfile%\Start Menu\Programs\WideStep Elite KeyLogger 2.6\View logs.lnk
- %Windir%\Help\ek_manual.chm
- %UserProfile%\Desktop\ek_setup.exe
- %System%\drivers\extfs.sys
- %System%\drivers\tdiip.sys
- %System%\drivers\usbkbd.sys
- %System%\mciole.dll
- %System%\windump.exe
  Note:
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
- %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
Creates the following registry sytbkeys:

HKEY_CLASSES_ROOT\CLSID\{333BD105-16D3-4169-B3C3-5090A69D691F} HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0A252B94-2FCD-BBF8-8ADD-AA019F83938E} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RFC1156Agent HKEY_LOCAL_MACHINE\SOFTWARE\WideStep\EliteKeyLogger HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\extfs HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdiip HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbkbd
Adds the following values:

"{R7C0DB872A3F777C0}" = "[HEX VALUES]" "{K7C0DB872A3F777C0}" = "[HEX VALUES]" "{I83E450369831F6EF}" = "[HEX VALUES]" "{083E450369831F6EF}" ="[HEX VALUES]"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Licenses
Adds the values:

"PNP_TDI" = "[HEX VALUES]"
"Filter" = "[HEX VALUES]"

to the registry subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GroupOrderListHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\GroupOrderList
Logs key strokes and catures screenshots.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}