1. Symantec/
  2. Security Response/
  3. Spyware.ActiveKeylog


February 13, 2007 11:34:53 AM
Winsoul Software, Inc.
Risk Impact:
File Names:
sys32win.exe akl.exe akl.dll Active Key Logger.exe
Systems Affected:

When Spyware.ActiveKeylog is executed, it performs the following actions:
  1. Adds the value:

    "sys32sql" = "[INSTALLATION PATH]\sys32win.exe"

    to the registry key:


    so that the spyware runs when Windows starts.

    • This risk may be installed through an installer, but the installation path is configurable. The variable [INSTALLATION PATH] refers to the path that is determined when the risk is installed, and the default value C:\Program Files\Active Key Logger.
    • The spyware may be configured to run in stealth mode, hiding its user interface and system tray icon.

  2. Creates the following files:

    • %UserProfile%\Desktop\Active Key Logger.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger License Agreement.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Uninstall Active Key Logger.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Visit the Official Active Key Logger Website.lnk
    • %UserProfile%\Start Menu\Programs\Active Key Logger\Active Key Logger on the Web.lnk
    • %ProgramFiles%\Active Key Logger\Active Key Logger.exe
    • %ProgramFiles%\Active Key Logger\Active Key Logger.chm
    • %ProgramFiles%\Active Key Logger\CMD16.dll
    • %ProgramFiles%\Active Key Logger\License.txt
    • %ProgramFiles%\Active Key Logger\Readme.txt2
    • %ProgramFiles%\Active Key Logger\smode.dll
    • %ProgramFiles%\Active Key Logger\Uninstall.exe1
    • %ProgramFiles%\Active Key Logger\Visit the Official Active Key Logger Website.url
    • %ProgramFiles%\Active Key Logger\akl.dll
    • %ProgramFiles%\Active Key Logger\AKL.url
    • %ProgramFiles%\Active Key Logger\order.txt
    • %ProgramFiles%\Active Key Logger\unins000.dat
    • %ProgramFiles%\Active Key Logger\unins000.exe

    • %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
    • %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.

  3. Creates the following registry subkeys:

    \Uninstall\Active Key Logger
    \Uninstall\Active Key Loggerr
    \Uninstall\Active Key Logger_is1

  4. Records keystrokes and may send recorded information to a predefined email address.

Summary| Technical Details| Removal

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube