from the doc:'A PHP-site generate the HTML-sites, where the strings are. The KeyLogger changes the startpage to: http://www.akosch.com/test/test.php?page=old startpage&text=strings If the startpage is called -> test.php saves the strings (-> generate the HTML-sites) akosch'
Windowssysedit.exe
HKEY_CURRENT_USERsoftwaremicrosoftwindowscurrentversionunsysedit