Spyware.AbsoluteKey

SUMMARY

Behavior

Spyware.AbsoluteKey is a program that logs keystrokes on your computer.

Symptoms

The files are detected as Spyware.AbsoluteKey.

Transmission

Spyware.AbsoluteKey must be manually installed.

Protection

• Virus Definitions (LiveUpdate™ Weekly) June 23, 2004
• Virus Definitions (Intelligent Updater) June 22, 2004

TECHNICAL DETAILS

When Spyware.AbsoluteKey runs, it performs the following actions:

1. Displays an End User License Agreement (EULA).
   
   
2. Prompts for the installation folder. The default installation folder is %ProgramFiles%AKL.
   
   Note: %ProgramFiles% is a variable that refers to the path to the program files folder. By default, this is C:Program Files.
   
   
3. Creates the following files:
   
   • %ProgramFiles%AKLAKL.exe
   • %ProgramFiles%AKLuninstall.exe
   • %ProgramFiles%AKLakl.dll
   • %ProgramFiles%AKLeadme.txt
   • C:Documents and SettingsAdministratorStart MenuProgramsAbsolute Key LoggerAbsolute Key Logger.lnk
   • C:Documents and SettingsAdministratorStart MenuProgramsAbsolute Key LoggerUninstall.lnk
   • C:Documents and SettingsAdministratorStart MenuProgramsAbsolute Key LoggerRead me!.lnk
   • %ProgramFiles%AKLunsetup.exe
   • %ProgramFiles%AKLunsetup.dat
   • C:Documents and SettingsAdministratorCookiesadministrator@lastbit[1].txt
   • %ProgramFiles%AKLkeylog.txt
   • %ProgramFiles%AKLcurlog.htm
     
     
4. Adds the subkey:
   
   AKL.exe
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp Paths
   
   and then adds these values to that subkey:
   
   "(Default)"="C:Program FilesAKLAKL.exe"
   
   "Path"="C:Program FilesAKL"
   
   
5. Adds the subkey:
   
   Vitas
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESOFTWARE
   
   
6. Adds the subkey:
   
   Absolute Key Logger
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESOFTWAREVitas
   
   
7. Adds the subkey:
   
   v1.5.243
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESOFTWAREVitasAbsolute Key Logger
   
   and then adds this value to that subkey:
   
   "(Default)"="C:Program FilesAKL"
   
   
8. Adds the subkey:
   
   last
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESOFTWAREVitasAbsolute Key Logger
   
   and then adds this value to that subkey:
   
   "(Default)"="v1.5.243"
   
   
9. Adds the subkey:
   
   Absolute Key Logger
   
   to the registry key:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall
   
   and then adds these values to that subkey:
   
   "DisplayName"="Absolute Key Logger"
   
   "UninstallString"="C:Program FilesAKLunsetup.exe /u"
   
   
10. Adds the subkey:
    
    Vitas
    
    to the registry key:
    
    HKEY_CURRENT_USERSOFTWARE
    
    
11. Adds the subkey:
    
    main
    
    to the registry key:
    
    HKEY_CURRENT_USERSOFTWAREVitas
    
    and then adds this value to that subkey:
    
    "firstTime"="1"
    
    
12. Adds the subkey:
    
    AKL
    
    to the registry key:
    
    HKEY_CURRENT_USERSOFTWAREVitas
    
    and then adds this value to that subkey:
    
    "dt" = 0x40D0E125
    
    
13. Adds the value:
    
    "run" = 0x1
    
    to the registry key:
    
    HKEY_CURRENT_USERSOFTWAREVitasAKLdt
    
    
14. Adds the subkey:
    
    t17
    
    to the registry key:
    
    HKEY_CURRENT_USERSOFTWARE
    
    and then adds this value to the subkey:
    
    "akl" = 0xAA3CDCB9

REMOVAL

The following instructions pertain to all Symantec antivirus products that support Security Risk detection.

1. Update the definitions.
2. Uninstall Spyware.AbsoluteKey.
3. Run a full system scan and delete all the files detected as Spyware.AbsoluteKey.
4. Delete the values that were added to the registry.
   

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To uninstall the Spyware

1. Click Start > Programs > Absolute Key Logger > Uninstall.
2. Follow the prompts.
   

3. To scan for and delete the files

1. Start your Symantec antivirus program, and then run a full system scan.
2. If any files are detected as Spyware.AbsoluteKey, click Delete.
   
   
   Notes:

• If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file name. Then use Windows Explorer to locate and delete the file.
• If you uninstalled the Spyware as described in the previous section, all the files may have been removed, and thus none of them will be detected.

4. To delete the values from the registry

WARNING: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Note: This is done to make sure that all the keys are removed. They may not be there if the uninstaller removed them.

1. Click Start > Run.
2. Type regedit, and then click OK.
3. Delete the following keys:
   
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionApp PathsAKL.exe
   HKEY_LOCAL_MACHINESOFTWAREVitas
   HKEY_CURRENT_USERSOFTWAREVitas
   HKEY_CURRENT_USERSOFTWARE 17
   HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstallAbsolute Key Logger
   
   
4. Exit the Registry Editor.