from the doc: 'The program "Dks v.1.3.1" is intended for tracking of pressing all keys in a system and management of the log-file with an obtained information. The program can work on systems MS Windows 9x/ME/NT/2000/XP. FreeWare. "AS IS". Before installation it is necessary closely to read and to accept all conditions of the licensing Agreement ("license.txt"). START OF THE PROGRAM: 1) Rewrites itself in the system catalogue MS Windows with name "Systemks.exe": Win-9x/ME - C:WINDOWSSYSTEMsystemks.exe Win-NT/2000 - C:WINNTSYSTEM32systemks.exe; Win-XP - C:WINXPSYSTEM32systemks.exe; ( hereinafter < WinSysDir >). 3) Creates 2 additional DLL "systemks.dll" (processing of pressed keys) and " sysadks.dll " (for auto start). 2) writes in the register parameters of load "system" dll "sysadks.dll", which on its start, starts "systemks.exe". ATTENTION! If a system WinNT/2000/XP and user is not the administrator, the keys of auto start in the register will not be created. DELETING OF THE PROGRAM: ATTENTION!!! On attempt of deleting of the program, it will be started again. It is possible to delete the program ONLY with the help of special deleting program "Deldks13.exe" in the catalogue DELDKS13 of the distribution kit. The deleting of the program with the help of TaskManager for NT/2000/XP - is forbidden. Deleting of the program on 9x/ME by the normal manager of processes (on "Alt"+"Ctrl"+"Del" the program is latent) - restart. WORK OF THE PROGRAM: During work of the of the program occurs braking of the buffer of accumulation of an information about the pressed keys on lines, length about 100 numerals, and dumping in the file "kslog.dat" after reaching a size of the buffer 1000 numerals or unloading DLL (the attribute of the file system, from an explorer is not seen).'
KeyLog-Dks trojanTrojanSpy.Win32.DKS.14
del_dks.exedel_dksh.exedeldks13.exedks131.exedks14d.exe