ActiveKeylog Description:

ActiveKeylog records keystrokes by the user and may send this information through email. ActiveKeylog can be installed as part of another program, or by an installer with a user interface.

While ActiveKeylog may be installed through an installer, the installation path is configurable, and the default is C:\Program Files\Active Key Logger. The spyware may be configured to run in stealth mode, hiding its user interface and system tray icon.

File names: sys32win.exe

When ActiveKeylog is executed, it performs the following actions:

1. Adds the value:
   
   "sys32sql" = "%installation path%\sys32win.exe"
   
   to the registry key:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
   so that the spyware runs when Windows starts.
   
2. Records keystrokes and may send recorded information to a predefined email address.

ActiveKeylog Automatic Removal:

Using Spyware Doctor to remove ActiveKeylog AUTOMATICALLY!

ActiveKeylog Manual Removal:

1. Update the virus definitions.
2. Uninstall Premeter using the Add/Remove Programs utility.

• Do one of the following:

  On the Windows 98 taskbar:

  1. Click Start > Settings > Control Panel.
  2. In the Control Panel window, double-click Add/Remove Programs.
     
     
  On the Windows Me taskbar:
  1. Click Start > Settings > Control Panel.
  2. In the Control Panel window, double-click Add/Remove Programs.
     If you do not see the Add/Remove Programs icon, click "...view all Control Panel options."
     
     
  On the Windows 2000 taskbar:
  By default, Windows 2000 is set up the same as Windows 98. In that case, follow the instructions for Windows 98. Otherwise, click Start, point to Settings, point to Control Panel, and then click Add/Remove Programs.
  
  

  On the Windows XP taskbar:

  1. Click Start > Control Panel.
  2. In the Control Panel window, double-click Add or Remove Programs.
     
     
• Click on Active Key Logger.
  
  
• Click Add/Remove, Change/Remove, or Remove (this varies with the operating system). Follow the prompts.

    4.    Delete the value that was added to the registry.

• Click Start, and then click Run. (The Run dialog box appears.)
• Type regedit
  
  Then click OK. (The Registry Editor opens.)
  
  
• Navigate to the key:
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
  
  
• In the right pane, delete the value:
  
  "sys32sql" = "%installation path%\sys32win.exe"
  
  
• Exit the Registry Editor.

More Removal Instructions for Adware/Spyware Programs - 'A'