Home Malware Programs Keyloggers Khoobe

Khoobe

Posted: March 28, 2006

Khoobe is a parasitic keylogger that records all the keystrokes that the user enters into certain windows of several softwares such as MSN Messenger and Internet Explorer. It transfers stolen data to a predetermined remote host. Khoobe can disable few standard computer tools like the Task Manager. The threat automatically runs on every Windows startup.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 winlogin.exe

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{RegistryKeys}HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr=1HKEY_LOCAL_MACHONESOFTWAREMicrosoftWindowsCurrentVersionRunWindowsUpdate=%System%winlogin.exe
Loading...