Troj/Keylog-I copies itself to the Windows system folder as MSKHPK.EXE and adds the following registry entry to run the Trojan on system restart:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\TwkCplDaemon =
"C:\<Windows system>\MSKHPK.EXE"
Troj/Keylog-I also drops a plugin within the Windows system folder as MSKHPK.DLL.
The Trojan attempts to log keystrokes and then email the keylogged information to an external address via smtp.