Troj/SCKeyLog-G is spyware which runs background processes and allows activity to be monitored on remote systems.
Troj/SCKeyLog-G includes detection for the following components:
VPASPScanner.exe
CGIScanner.exe
PHPScanner.exe
which represent a monitoring tool that captures users' activity, saves it to an encrypted logfile and periodically sends it to the intruder.
When executed the main component extracts a main executable and a dll file to the Windows system32 folder, installs a background service, changes the system registry and sends the notification email to the remote address.
The executables may have the following filenames:
secsrvrc.exe
secsrvrc.dll
win_spool2.exe
win_spool2.dll
with the corresponding registry entries:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
Run "secsrvrc"=C:\\WINDOWS\\System32\\secsrvrc.exe"
HKLM\Software\Microsoft\Windows\CurrentVersion\
Run\ win_spool2 ="C:\\WINDOWS\\System32\\win_spool2.exe"