Spyware.SpyKeylogger

Behavior
Spyware.SpyKeylogger is a security risk that records keystrokes.

Symptoms
One or more files are detected as Spyware.SpyKeylogger.

Transmission
Spyware.SpyKeylogger must be manually installed.

technical details
File names:
SpyKeylogger-install.exe
kl.dll
skl.dll
skl.exe
sklc.dll
skls.exe

When Spyware.SpyKeylogger is installed, it performs the following actions:

1. Creates the following files:

* %UserProfile%\Start Menu\Programs\Spy-Keylogger\Help for Spy-Keylogger.lnk
* %UserProfile%\Start Menu\Programs\Spy-Keylogger\License.lnk
* %UserProfile%\Start Menu\Programs\Spy-Keylogger\Readme.lnk
* %UserProfile%\Start Menu\Programs\Spy-Keylogger\Spy-Keylogger.lnk
* %UserProfile%\Start Menu\Programs\Spy-Keylogger\Uninstall Spy-Keylogger.lnk
* %ProgramFiles%\SpyKeyLogger\kl.dll
* %ProgramFiles%\SpyKeyLogger\license.txt
* %ProgramFiles%\SpyKeyLogger\readme.txt
* %ProgramFiles%\SpyKeyLogger\skl.chm
* %ProgramFiles%\SpyKeyLogger\skl.dll
* %ProgramFiles%\SpyKeyLogger\skl.exe
* %ProgramFiles%\SpyKeyLogger\skl.ini
* %ProgramFiles%\SpyKeyLogger\sklc.dll
* %ProgramFiles%\SpyKeyLogger\skls.exe
* %ProgramFiles%\SpyKeyLogger\Uninstall.exe

Notes:
* %UserProfile% is a variable that refers to the current user's profile folder. By default, this is C:\Documents and Settings\<Current User> (Windows NT/2000/XP).
* %ProgramFiles% is a variable that refers to the program files folder. By default, this is C:\Program Files.

2. Creates the following registry subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\••8•9••••-••••-••••-••3•-11••••18•••••
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\skl.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Spy-Keylogger
HKEY_LOCAL_MACHINE\SOFTWARE\Spy-Keylogger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SPYKEYLOGGERSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application\SpyKeyloggerService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SpyKeyloggerService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SPYKEYLOGGERSERVICE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\SpyKeyloggerService
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SpyKeyloggerService

3. Adds the value:

"Spy-Keylogger" = "%ProgramFiles%\SpyKeyLogger\skl.exe"

to the registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

so that the risk runs every time Windows starts.

4. Adds the value:

"Sources" = "SpyKeyloggerService"

in the registry subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Application
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Sources

5. Records keystrokes.

REMOVAL INSTRUCTIONS
See: http://securityresponse.symantec.com/avcenter/venc/data/spyware.spykeylogger.html