KGBKeylogger
|
Description:
|
Spyware
|
|
Risk Level:
|
High
|
|
Date of First Occurence:
|
Tuesday, April 15, 2008
|
|
Software Developer:
|
(unknown)
|
|
Brief Info:
|
KGB Keylogger invisibly monitors and records all of your computer activity. This information is then automatically emailed to an anonymous user.
|
|
Removal:
|
This threat can be removed using "Spyware
Terminator"
|
SUPPRIMER SPYWARE »
Geographical Distribution of Threat "KGBKeylogger"
Threat Info
View All
Detected Items
- Detected Files:
%PROGRAMFILES%\KGB\unins000.exe
MD5: BC9705317F5BB074C442C4443B027212 Size:685849
MD5: 8A72A2D578C2935615EC1A7BCDB71304 Size:686511
%PROGRAMFILES%\KGB\MPKView.exe
MD5: 17064EB4585504177F7F521CD5FDB3E5 Size:2223104
MD5: 71480004F04ECB1B8788078734EC8D4B Size:2311168
%PROGRAMFILES%\KGB\SQLite3.dll
MD5: FEC17D5FB09A03376D3AA204C65562A7 Size:362029
%PROGRAMFILES%\KGB\Mpk.exe
MD5: C61FA25E2709D7181108E918B6C24A3D Size:1226240
%PROGRAMFILES%\KGB\MPK.dll
MD5: 7AD1AE5475050FE2363B4B502F6CB8D0 Size:53248
%PROGRAMFILES%\KGB\libeay32.dll
MD5: A0EF1E32A11713118FF1D8CEC4C0AEA0 Size:684032
%PROGRAMFILES%\KGB\ssleay32.dll
MD5: 4ADAA6BF3E4658045F8C09B75956B83B Size:155648
- Detected Files with variable Filenames:
Detecting items list:
- Files by Name
%ALLUSERS_APPDATA%\MPK\key.bin
%ALLUSERS_APPDATA%\MPK\mpk.db
%DESKTOP%\KGB Spy.lnk
%programfiles%\KGB\Mpk.dll
%programfiles%\KGB\MPK.exe
%programfiles%\KGB\MPKView.exe
%programfiles%\KGB\sqlite3.dll
%programfiles%\KGB\ssleay32.dll
%programfiles%\KGB\unins000.exe
%programfiles%\KGB\unins000.dat
%programfiles%\KGB\Uninstall KGB Spy.lnk
%programfiles%\KGB\libeay32.dll
%programfiles%\KGB\German.lng
%sysdir%\runmpk.lnk
- Files by MD5
MD5: AF1A377E0581A18BF5CC93768A87C676 Size: 4264457
MD5: E1797172F7F8CA33113F12C60960CDC1 Size: 36864
MD5: 3B21F345E1306745C92B8A8F7F92220C Size: 904192
- Files by Directories
%ALLUSERS_APPDATA%\MPK\1
%ALLUSERS_APPDATA%\MPK\2
%START_PROGRAMS%\KGB Spy
%programfiles%\KGB\Help
- Files by CLSID or Name
CLSID=B313EEA2-2FCF-432F-A1B9-5751BF6D6CE2
- Registry Keys
HKCR\mpkreg
- Registry Values
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ValueName=%programfiles%\KGB\MPK.exe
HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List ValueName=%programfiles%\KGB\MPKView.exe
«
Go to Software Database
