This looks like what you're talking about:

http://packetstorm.foofus.com/Exploit_Code_Archive/xscan.tar.gz

Just a quick note to anyone using this app. I've compiled and run this successfully under Cygwin but beware, the output filename for this tool is KEYLOG[hostname]:0.0

Anyone spot the issue with this? If you tun this under cygwin you'll get a file name KEYLOG[hostname] with a ADS stream named 0.0 instead of the intended filename. xscan inadvertently hides the output of the keylogger, shame about the woefully obvious file name ;-)

The reason I dug this tool up again is that I've seen some resurgence in vulnerable X servers, particularly since Cygwin has gained more popularity. Anyone else have any similar experience?

Jim