How to find and remove a keylogger?

[Taylor]

I have stumbled upon a keylogger and I don't know how to get rid of it. Any tips would be appreciated.

Taylor

[Tx Redneck]

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.

[Taylor]

Malwarebytes' Anti-Malware 1.50.1.1100

https://www.malwarebytes.org

Database version: 6210

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

3/29/2011 10:26:52 PM
mbam-log-2011-03-29 (22-26-52).txt

Scan type: Quick scan
Objects scanned: 208421
Time elapsed: 11 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(defa ult) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Users\Taylor\AppData\Local\Temp\0.2767771048406 451.exe (Trojan.Agent) -> Quarantined and deleted successfully.

[Danny46]

Gonna do this. I think I have something in here that MaCfee isnt catching. Speaking of that, what do you think of Macfee?

[Tx Redneck]

I'd like you to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the icon on your desktop.
4. Check
5. Click the button.
6. Accept any security warnings from your browser.
7. Check
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the button.
13. Push

[Tx Redneck]

Gonna do this. I think I have something in here that MaCfee isnt catching. Speaking of that, what do you think of Macfee?

I don't like it at all. There are freebies that afford better protection without the hit on performance of your machine.

[Pokulski-Blatz]

I don't like it at all. There are freebies that afford better protection without the hit on performance of your machine.

like?

[Tx Redneck]

Microsoft Security Essentials, Avast and Panda Cloud are my three preferred freebies with Avira coming in 4th. Avira isn't quite what it used to be but is still effective.

Go here and view the pdf for 2010's summary report of the big named av's.

http://www.av-comparatives.org/comparativesreviews/summary-reports

[Danny46]

I will check that out, thanks! I got Macfee because I get a discount on it, but it really slows my system down and ive been pretty disapointed with its virus protection.

[Raskal]

Malwarebytes' Anti-Malware 1.50.1.1100

https://www.malwarebytes.org

Database version: 6253

Windows 6.0.6000
Internet Explorer 7.0.6000.17037

4/3/2011 4:38:29 AM
mbam-log-2011-04-03 (04-38-29).txt

Scan type: Quick scan
Objects scanned: 158586
Time elapsed: 6 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 2
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\RichVideoCodec (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run\MSFox (Malware.Trace) -> Value: MSFox -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\(defa ult) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Folders Infected:
c:\programdata\48689789 (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\248664158 (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:
c:\programdata\248664158\248664158.glu (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\248664158\pc248664158cnf (Rogue.Multiple) -> Quarantined and deleted successfully.
c:\programdata\248664158\pc248664158ins (Rogue.Multiple) -> Quarantined and deleted successfully.



man my thing had some f'd up stuff.

[Tx Redneck]

Did it make any difference in how your machine works?

[ceyko]

How do you know you have a key logger installed? By design, if you're not running any AV...etc they are made to be non-detectable. Both the hardware and software versions.

[Taylor]

How do you know you have a key logger installed? By design, if you're not running any AV...etc they are made to be non-detectable. Both the hardware and software versions.

Got my wow account hacked.