Logicaly’s guide: How to CLEAN your PC from keyloggers.

Hi all, this guide will help you on how to clean your pc from keyloggers.
Last update: February 8, 2010

Screenshots have now been added!!!
Please also take a look at the Unofficial Helper's Forum (with IRC!)
> http://www.bamboobix.info < (Thanks to Anayra for running this!)


English is not my mother tongue, so some things are hard for me to explain, but I think i'm doing a good job, in general ^^

First of all, a note: Hijackthis is a tool, used for finding infections in your computer. Please note: THIS IS NOT A SCANNER. It shows both malicious rules, but also LEGIT rules. Do not fix rules in Hijackthis yourself!
You can find a list of forums that are qualified to look at your Hijackthis log here: http://asap.maddoktor2.com
In addition, here’s a list of forums where you can post your hijackthis logfile. – If you know any others, please let me know in a comment/reply!
Dutch/Belgium:
www.hijackthis.nl/forum
www.minatica.be/forum.php
http://www.antispywareoffensief.nl/forum/

English:
http://www.spywareinfoforum.com/
http://forums.techguy.org/
http://www.techsupportforum.com/


Before posting a Hijackthis log, please do the following steps upfront. I know this is a lot of work, but that way most malware is already deleted and your logfile can be looked at faster.
Please remember: Follow ALL steps, including step 7

Note: Vista/Win. 7 users must run installations and the downloaded programs as Administrator. You can do this by right-clicking the program and select Run as Administrator (The screenshot shows it for Hijackthis, You must use this for every program we use here)
http://img408.imageshack.us/img408/6665/guide1bb5.jpg <-- Screenshot

1.

Download CCleaner here: http://www.piriform.com/ccleaner/download - and install it.

Once it’s booted, press the button to Clean up your system.

This can take a few minutes, depending on how much trash there is on your PC. Please read what is being removed, you might not want the program to remove your Internet History or saved passwords.
Note: CCleaner can ask you to install Yahoo Toolbar during the installation. Uncheck this option if you do not want the toolbar!
Screenshot: http://www.plaatjesupload.nl/bekijk/2010/02/08/1265647242-080.jpg


2.

Download Ad-aware Free Anti-Malware 8 http://download.cnet.com/Ad-Aware-Free-Anti-Malware/3000-8022_4-10045910.html - and install it.

If you get an license note during the installation, press Use Free.

After the installation Ad-Aware may ask you to reboot before the first use. Please do this! Once the system is rebooted, start Ad-Aware.

It should update automatically, and this can take quite a while the first time. Just wait. If it doesn’t update automatically, do it manually by clicking the update-button.
Once Ad-Aware has finished updating, it might magically disappear.. It’ll be in your taskbar!

Click on the Systemscan button. Wait until it is finished.

Once it is finished, make sure you select everything and Quarantine/Delete it.[/li

Close Ad-Aware once everything is completed.

Screenshot: http://www.plaatjesupload.nl/bekijk/2010/02/08/1265649713-640.jpg


3.

Download Spybot Search & Destroy http://www.safer-networking.org/nl/mirrors/index.html - and install it.

During the installation, uncheck "Use Internet Explorer protection (SDHelper)" and "Use system settings Protection (TeaTimer)"

After the installation, boot Spybot S & D. Search for updates first, and download them all.

Click on the Immunize tab afterwards, followed by clicking the Immunize button.

Wait until the operation has been completed.

Then go to the Search and Destroy tab. Click on Check All after that and wait until things are done.

Select all problems found, and repair the problems.

Close Spybot afterwards.
Screenshot: http://www.plaatjesupload.nl/bekijk/2010/02/08/1265650645-650.jpg

4.

Download MBAM (MalwareBytes' Anti-Malware) http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html - and install it. Make sure that at the end of the installation, Update MalwareBytes' Anti-Malware and Start MalwareBytes' Anti-Malware is checked.

Select Full Scan and start scanning. When it is done, select everything and delete the found objects.

A logfile will also open automatically. Save this logfile and post it together with your Hijackthis logfile.

The Logfile will automatically be saved at the Logs tab in MBAM.
If MBAM found objects that can't be deleted, it will ask to reboot your computer. Allow this and restart your computer.
Screenshot: http://www.plaatjesupload.nl/bekijk/2010/02/08/1265650977-740.jpg

5. Do a full system scan with your virusscanner and remove all found infections.
If you do not have a virusscanner – GET ONE ASAP!!- , you can scan online with one of these scanners. (Use Internet Explorer to scan)

BitDefender: http://www.bitdefender.com/scan8/ie.html
Panda: http://www.pandasoftware.com/activescan/com/activescan_principal.htm
Kaspersky: http://www.kaspersky.nl/scanner

Remove all infections found.

6. Restart your computer.

7.

Download Hijackthis http://go.trendmicro.com/free-tools/hijackthis/HijackThisInstaller.exe - and install it.

After the installation Hijackthis will open. Press Do a systemscan and save a logfile.
A notepad file will open. In the Notepad file, press CTRL + A to select everything, CTRL + C to Copy everything. Then press CTRL + V in a new topic at the forum you want to post the log.

Screenshot: http://www.plaatjesupload.nl/bekijk/2010/02/08/1265651202-490.jpg

Also paste the MBAM log on the forum you place the Hijackthis logfile.


Many thanks for reading, if you have questions or problems, please ask :)

Also: Please note: Doing this all, is NOT A GUARANTEE your computer is not infected. There is no scanner that has a 100% detection rate.

- Logicaly
PS. Logicaly is my new main. The old one was Magekíd. It’s still me :D
PSS. To that sneaky person posting in the US forums: WTB credits-link!

Please do NOT post your hijackthis logs in a reply/thread here, I'll most likely only redirect you to the correct forum ^^ (which you can see at the top of the post)
Edit: /sigh, people do it anyways:< Ah well.. /love

Thank you both ;) I hope the people who need it also find it useful :)

- Magekíd

AD-Aware is rather rubbish. Spybot is much better, by far.

Just use linux :)

---

Q u o t e:
Just use linux :)

---

Or shoot yourself in the head, same effect :)

You could have posted it a lot shorter by just saying use Hitman Pro, which uses all the tools described above.


More info: http://www.hitmanpro.nl/hitmanpro/content/view/3/9/lang,en/

* Downloads and installs automatically well-known anti-spyware programs, such as CWShredder, Ad-Aware, Spybot S&D, Spy Sweeper, Ewido Micro, Spyware Doctor, Spyware Blaster, NOD32, Windows security updates, hotfixes against unpatched security leaks, etc.
* Downloads automatically the latest updates (this is often a manual task without Hitman Pro).
* Controls automatically the third-party anti-spyware programs. Scans and removes found threats and protects against malicious ActiveX components.
* Makes use of (if applicable) purchased versions of commercial anti-spyware programs (such as NOD32, Ad-Aware, Spy Sweeper, Spyware Doctor).
* Configures the anti-spyware software for optimal results.
* Generates one comprehensive report and presents the user with a clear picture on contamination and protection.
* Expert-function for advanced users for full control over the found objects (files, registry keys)

The version of Hitman Pro you are talking about is rubbish imo ;) Generally, it's not being recommended by Anti-Malware forums. Uses alot of software with trials, having bugs (suddenly stops, or doesnt delete infections found and just continue). The newer version of Hitman Pro doesn't use these scanners, and that one is nice. However it doesn't use NOD32, Ad-Aware etc... just a standalone scanner from Hitman Pro itself.

- Magekíd

Huge amount? 3 scanners, 1 trash cleaner (like ccleaner), online scanners (no software installation) and Hijackthis, (which is no scanner, only generates a report from/about your computer)

Not that much imo ^^

Careless? If you manage to keep ur pc 99% clean that way, nah, but if you download pr0n, torrents, and whatever, yes :)

Well if it turns out you DO get infected, here's what to do :)

---

Q u o t e:
Blue tagged as well :-)

This should be very useful for those who were looking for attractive legs ;-)

---

Vaneras you are the best Blizzard Poster there is, have my sex legs.

---

Q u o t e:
Hi everybody,

---

Hi Dr Nick!

If you get curious about your posting being reported, I'm responsible for that. This deserves some sticky goodness.

I can finally have sex legs without a threat of keylogger! Thanks!

Nice idea

today someone posted this link about warlcok t7 ( was the picture for pink coloured boa paladin t5?? ) and had the link wowinsidAr i just clicked it since everyone was makeing a funny about it, when 2 people sharted shouting keylogzor etc.

i just did these scans and nothing turnes up. it was funny to see tho, that the scans i used where exactly the same as you posted here, just 1 little difference, i also use a free scanner(spyeraser), that cannot remove the files ( need to pay for that ). i found that this particular scanner would find more files then any of my other scanners, including problems in my registry keys ( which can be deleted manually ).

i was happy none of the scans did show up something, just shows how people are quick to call out keylogger, and might get innocent posters banned.