Overview
Vendor Notes:
Alias:
Category:
Key Logger: (Keystroke Logger). A program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack. For example, a key logger will reveal the contents of all e-mail composed by the user. Keylog programs are commonly included in rootkits and RATs (remote administration trojans).
Variants:
Similar Pests:
Origins
Group:
By This Group:
EMail:
URL:
Programming Language:
Date of Origin:
Distribution
Prevalence:
Clot Factor:
The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.
Operation
Storage Required:
Risks
Detection Issues:
Detection and Removal
Automatic Removal:
PestPatrol detects this.
PestPatrol removes this.
Manual Removal:
Kill these running processes with Task Manager:
Go To the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
If you find the value HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\sys32cmd, delete it and reboot the machine immediately.
Unregister these DLLs with Regsvr32, then reboot:
Remove these registry items (if present) with RegEdit:
Remove these files (if present) with Windows Explorer:
Remove these directories (if present) with Windows Explorer:
Research
File Analyses:
- Active Key Logger: active key logger.lnk · active key logger.txt · akl.exe
- Active Key Logger 1.8: active key logger 1.8.exe · akl help.chm · license.txt · order.txt · sys32win.exe · ttian.net.htm · unins000.dat · win32pc.dll
- Akl2.0: active key logger.lnk · akl help.chm · akl.exe · akl2.0.txt · keylog.txt · license.txt · sys32win.exe · ttian.net.htm · uninstall.lnk