Content

Spyware-Keycollect

Type
Program
SubType
Spyware
Discovery Date
11/15/2005
Minimum DAT
4628 (11/15/2005)
Updated DAT
4628 (11/15/2005)
Minimum Engine
5.1.00
Description Added
11/15/2005
Description Modified
12/23/2005 4:57 AM (PT)

Tab Navigation

Characteristics

McAfee(R) AVERT recognizes that this program may have legitimate uses in contexts where an authorized administrator has knowingly installed this application. If you agreed to a license agreement for this, or another bundled application, you may have legal obligations with regard to removing this software, or using the host application without this software. Please contact the software vendor for further information.

See http://vil.nai.com/vil/DATReadme.asp for a list of Program detections added to the DATs.

See http://vil.nai.com/vil/pups/configuration.htm for information about how to enable, disable, and exclude detection of legitimately installed programs.

Distribution

This is not a virus or a trojan. It is detected as a "potentially unwanted program." It is a keylogger which logs keystrokes typed by the user. It can be put into a "stealth" mode such that no obvious indication is given that it is installed or running. A user interface is displayed on launching the installation executable.

Installation

File: recorder.exe
Hash: 2cad891b4aefe8ffccebbd82adf2cf72

Upon installation of this program, the following changes occur in the user's system.

System Changes
General defaults for typical environment variables (although they may be different, they usually are not):
%WinDir% = \WINDOWS (Windows 9x/ME/XP), \WINNT (Windows NT/2000)
%SystemDir% = \WINDOWS\SYSTEM32 (Windows 9x/ME/XP), \WINNT\SYSTEM32 (Windows NT/2000)
%ProgramFiles% = \Program Files
%UserProfile% = C:\Documents and Settings\[CURRENT USER] (Windows NT/2000/XP).
%AllUserProfile% = C:\Documents and Settings\All Users (Windows NT/2000/XP).

Files Added

  • %WinDir%\rwin1.dat  
  • %WinDir%\winrv3e.exe  
  • %WinDir%\Winw35.ini
  • %ProgramFiles%\keycl\keytrial.exe
  • %ProgramFiles%\keycl\readme.txt
  • %UserProfile%\Desktop\Keyboard Collector Trial.lnk

The program records user's keystrokes in a log file "rwin1.dat" dropped
in "%WinDir%".

Registry

Upon execution, the program hooks itself to system startup, by creating the following run entry in system registry.

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
    CurrentVersion\Run|Wdrvfig7
    "Value data"=""%Windir%\WINRV3E.EXE"

Screenshots

Aliases

Aliases

    N/A