Spyware.BeyondKeylog

Printer Friendly Page

Updated: February 13, 2007 11:45:50 AM

Type: Spyware

Version: Supremtec

Risk Impact: Medium

File Names: csrss.exe

Systems Affected: Windows 2000, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

When Spyware.BeyondKeylog is executed, it performs the following actions:

Creates the following files:
- %ProgramFiles%\Supremtec\csrss.exe
- %ProgramFiles%\Supremtec\help.chm
- %ProgramFiles%\Supremtec\Home.url
- %ProgramFiles%\Supremtec\Purchase.url
- %ProgramFiles%\Supremtec\tips
- %ProgramFiles%\Supremtec\unins000.dat
- %ProgramFiles%\Supremtec\unins000.exe
- %ProgramFiles%\Supremtec\UninsHs.dat
- %ProgramFiles%\Supremtec\UninsHs.exe
- %System%\emconv.exe
- %System%\rgtcvc32.dll
- %UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Beyond.lnk
- %UserProfile%\Application Data\Microsoft\HTML Help\hh.dat
- %UserProfile%\Desktop\Beyond.lnk
- %UserProfile%\Start Menu\Programs\Supremtec\Beyond Keylogger.lnk
- %UserProfile%\Start Menu\Programs\Supremtec\Beyond.lnk
- %UserProfile%\Start Menu\Programs\Supremtec\Purchase Beyond Keylogger.lnk
- %UserProfile%\Start Menu\Programs\Supremtec\Uninstall Beyond Keylogger.lnk
- %UserProfile%\Start Menu\Programs\Supremtec\Visit Beyond Keylogger Site.lnk
  
  Note:
- %System% is a variable that refers to the System folder. By default this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
- %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.
- %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
Copies the following files:
- %System%\comdlg32.ocx
- %System%\ijl11.dll
- %System%\mscomct2.ocx
- %System%\mscomctl.ocx
- %System%\msflxgrd.ocx
- %System%\msrep32.dll
- %System%\msstdfmt.dll
- %System%\mstrc32.dll
- %System%\msvbvm60.dll
- %System%\mswinsck.ocx
- %System%\richtx32.ocx
- %System%\scrrun.dll
- %System%\stdole2.tlb
  
  Note: These are legitimate copies of Microsoft Windows files.
Adds the value:

"csrss" = "%ProgramFiles%\Supremtec\csrss.exe"

to the registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runso that the risk runs every time Windows starts.
Creates the following registry subkey:

HKEY_LOCAL_MACHINE\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Beyond Keylogger 1.5_is1
Captures the following events and writes them to %ProgramFiles%\Supremtec\LOG.
- Keystrokes
- Information copied to clipboard.
- Screenshot on every mouse click or every time the Enter key is pushed.
- Microphone sounds.
- Web sites visited.
Sends the information logged to a configurable email address.

Removal

Summary

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}