My antispyware recently discovered and blocked a keylogger. Is it better to just block or delete it?

Question

After finding this we immediately changed our passwords. 2 days later my email address sent spam to 50 people, each with 4 CCs. Thats spam (most having to do with viagra) sent to about 250 people.

Answer 1

Keyloggers can be very difficult to remove. I recommend you follow this procedure to open all areas of your computer for the best chance of complete removal. Do every step. The AVG Antispyware is the old ewido program. It is very good at detecting and removing Keyloggers.

Trojan Removal Procedure.

Removing infections from your computer is never as easy as aquiring them. Malware infections are not meant to be removed so it takes TIME and PATIENCE to get rid of them. If you do not have T & P then you can always do a Reformat.

Malware is a general word for all form of Viruses, Spyware etc. This procedure works for all Malware. Replace the Ewido program with the appropriate program.

You might be unable to access the Internet after removing the Malware so you will need to run LSPfix or Winsockxpfix (as appropriate). Download one and save to desktop, run it later.

LSPfix: all Windows OS except 95.

http://www.cexx.org/lspfix.htm

Winsock XP Fix: Windows XP only.

http://www.spychecker.com/program/winsoc...



Download and Update Ewido (now called the AVG Antispyware):

http://www.ewido.net/en/download/...


-- If you have problems updating see here:

http://www.ewido.net/en/download/updates...

Once the updates are installed do the following:



Let's get cleaning

Part 1

• Temporarily show hidden files.

For Windows XP:

1.
Click Start, and then click Control Panel.

2.
Click Appearance and Themes, and then click Folder Options.

3.
On the View tab, under Hidden files and folders, click "Show hidden files and folders", and clear(uncheck) the "Hide protected operating system files" check box.



For older systems:

1.
Double-click My Computer, click View, and then click Folder Options.

2.
On the View tab, under "Hidden files and folders", click "Show hidden files and folders", and clear (uncheck) the "Hide protected operating system files" check box.


IMPORTANT: Files are hidden by Windows for a very good reason. It is not wise to experiment with these files. Unfortunately, to successfully remove modern spyware we must turn this protection off temporarily. Please turn the protection back on when you have finished cleaning your system.


Empty your Internet Explorer cache and your other temporary file folders:

1.
On the Internet Explorer Tools menu, click Internet Options.

2.
On the General tab, in the Temporary Internet Files section, click the Delete Files button. This will delete all the files that are currently stored in your cache.

3.
Select the Delete all offline content check box in the confirmation dialogue box that appears, click OK.

4.
Click OK again.

Restart in Safe Mode:

To do this you need to hold down or repeatedly tap the F8 key while the computer is booting (when the computer is displaying a black screen with white text). When the boot menu appears, use your keyboard arrows to select "Safe Mode."

Safe Mode can look quite ugly. The color may look bad, and all of your desktop icons will be very large. This is normal.



Start Scan and let Ewido scan the PC


When the scan and removal are completed REBOOT COMPUTER. This will restart you in normal mode.

If you are unable to access the Internet after removing Malware you will need to run LSPfix or Winsockxpfix (as appropriate).


If you are using Windows XP Service Pack 2 (SP2) and are unable to access the Internet after removing Malware, there is a command that may fix the problem, removing the need to run Winsockxpfix. It works by resetting the winsock catalogue. Click on Start, then Run and type CMD in the dialogue box that appears. Click OK. Type "netsh winsock reset" (no quotes)into the DOS window that appears.


The last steps

If you are running Windows XP or Windows ME, and your computer has been successfully cleaned of Malware, there is one more thing that needs to be done.

Delete any old restore points and then create a new restore one. The old ones may, of course, be infected with the Malware and cannot be used.

First, start and then stop the Restore Service. This is done differently depending on what operating system you are running.

Windows XP:

1.
Click Start, and then click Control Panel.

2.
Click Performance and Maintenance, click System, and then click on the System Restore tab.

3.
Select the Turn Off System Restore check box, click Apply, then restart your computer.

4.
Return to the System Restore Tab and turn System Restore back on.


Windows ME:

1.
Click Start, click Control Panel, click System.

2.
Click Performance, click File System, and then click Troubleshooting.

3.
Enable the option Disable System Restore, click Apply then restart your computer.

4.
Return to the Troubleshooting tab and turn System Restore back on.


To set a manual restore point complete the following steps:

1.
Click the Start button.

2.
Point to Programs, then navigate to Accessories, then System Tools, then click System Restore.

3.
Choose Create a restore point, and then click Next.

4.
In the Restore point description box, type a name for your restore point, and then click Next.

5.
Click OK.


There are Trojans that fall into the Smitfraud family. These require the use of a specialized program for removal. Here are two sites that specialize in removing these:

http://www.internetinspiration.co.uk/rog...

http://siri.urz.free.fr/fix/smitfraudfix...

Answer 2

dont ask anyone, just delete it immediatly.coz keylogger are made for only one perpose ; to obtain someone's cofidential information. if your system is compromised it can do any thing whatever ' they' want. i.e. your e-mail password ,your bank account detail,etc can be obtain by the hackers.basically keylogger are simply a software which keeps record of every key strock that you hit on your keyboard.but nowadays there are lots of keyloggers which are associated with spyware.so if you are aware of spyware than it needless to explain.but there is a question, how much you are sure that the keylogger on your system was a simply piggyback stuff which came through the net without sombody's knowledge ? even you delete it for now but the question remains the same ; may be somebody in your family or your friend wants to spy on you !!!!! and if there is only one user account on your pc then there is a strong chance. there are hundreds of keylogger ( which are free version but for a limited period) avilable on the net, which runs on background absulutly in a stealth mode . even if you are a administrator its very hard to dig it out untill you know the settings
mostly it is like a cobination key.well , may be you are confused ;...........what ? spy on me !!!!!!!!!! but its true it happened to me several times. here is an idea; if you want to spy on someone your friend or any of your family member and you share the same pc just go to the www.download.com and search for the spy software or keylogger you can choose one and download it after you run it then just set it as you like and what .......... ya next day may be you will get an e-mail containing all the log of the day and even the screeshots then what ............
i dont know what you will do .
thanks

Answer 3

I know most ppl here are saying to delete it but personally I'd pick 'block'. This way if the infection should try to penatrate your pc, the software has a 'rule' to go by (which is the block) instead of having to re-ask you what to do with it...

Answer 4

Delete. Better to be safe than sorry.

Keyloggers send your information back to someone else. Thats passwords; credit card numbers; etc

If you have the ability, I would wipe\rebuild the system to ensure it is clean.

Answer 5

I hate it whilst in actual existence somebody is conversing to me and that i think of in my head "I desire i might desire to dam you" and then I chuckle. style of uncontrollable-like. and that i can't probable tell the guy why i'm giggling. So I could rapid make some thing up and it by no ability comes out appropriate. So I purely turn around rather quickly and run away.

Answer 6

delete it. if you get zonealarm firewall it will stop spyware from reporting back to it's owner. this is good if you miss some of the spyware with a spyware removal tool

Answer 7

Delete it.

Answer 8

delete it

Answer 9

DELETE IT!!!