Scans hosts or subnets looking for unsecured X clients. If it finds one it starts logging all keystrokes to that session.
Application/X-Scan.A [Panda]Exploit/IIS.WebDir [Panda]mIRC/Flood!Trojan [Computer Associates]RmtCfg!Data!Trojan [Computer Associates]Tool-Xscan [McAfee]
c:x-scan-v2.3-enxscan.exec:x-scan-v2.3-enxscan_gui.exe
c:x-scan-v2.3-endatwry.dllc:x-scan-v2.3-enoncrpc.dll