Just found keystroke logger (klogger.exe from Kelly Software) on my work

[roseBudd]

PC. I have quarantined it. Would like to know details, such as when, (registry?) where (looks like it reports to Documents and Setting/myname/recent/readme.txt.lnk a 1K shortcut which appears to point to E:

D is my CD drive

Would love to read that txt file.

[FreakinDJ]

1. Your work PC must be networked

[roseBudd]

5. It is but I have no E drive mapped, how do I find E on the network?

[FreakinDJ]

13. You don't have an E drive

its on the network - and NO you probably do not have rights to the file

There is nothing you can legally do about it

So just crash the computer and see what you get on the new one

Thats what I did

[roseBudd]

19. So the drives on the network that are skipped over are the secret drives?

[FreakinDJ]

22. NO but you can only see what you are grant network RIGHTS

too.

Its kinda like a security clearance. If the network admin hasn't granted you rights to the file, no matter where the physical location you will not be allowed to see it.

Every thing is an object. Programs, files, users, are all objects

[roseBudd]

24. I only have one readme.txt.lnk in myname/recent. The shortcut

appears to point to the root of E:

The documentation on this logger says it writes logs to a *.tmp in the root of C.

[FreakinDJ]

30. That is just where the resulting file is deposited

The actual software resides on your computer except it is awfully hard to find. Some are vulnerable to the search function if you know what you are looking for. Then you need to corrupt only a few lines of code to disable it.

Do you have a file name from the logger prog

[roseBudd]

31. Yeah, it's quarantined it uses sys007s.exe and sys007dll.dll

[rzemanfl]

2. Just found one on my home PC. n/t

[FreakinDJ]

14. Do you have a jealous suspecious wife

or a girlfriend

[rzemanfl]

27. No, it is malware of some sort. My son is home and was on the

Net.

[JuniperLea]

3. Either your employer is monitoring your activity

Or an outside source. These keyloggers can usually be sent to someone without their knowing through an email, or an email attachment. A fake .jpg can do the same.

[Turbineguy]

4. Whoa Dude!

I just found one too!!

It points to [e-mail]

Just Kidding. Will Spybot S&D get rid of it?

[roseBudd]

6. I found this one with counterspy, adaware and trendmicro missed it

[populistdriven]

7. I work in IT (12 years) and the best thing I have found is

this http://www.xblock.com/

it is the only scanner that picks up winwhatwhere and spector pro

both of which are commercial system monitors that cost hundreds of dollars

I also highly advise you to (in addition to xblock) use a registered antivirus program such as www.f-secure.com and:

use process explorer and root kit finder both of which are free at wwwsysinternals.com and excellent.

[roseBudd]

10. Apparently keylogger.exe by Kelly Software is free, does this mean

less likely planted by corporate? It is a very big Co. and doesn't use freeware

[populistdriven]

11. yes, big corporations use licensed software but that doesn't stop

coworkers and bosses from using them (against company policy)

process explorer and another app (http://www.sysinternals.com/Utilities/Filemon.html) at sysinternals will tell you exactly what files are involved so long as the keylogger is actively running

[roseBudd]

16. I can't see an E: drive on the network, most of the drive letters are way

down the alphabet like J:, R: etc. How do I figure out what E is since it's only 1 drive past my CD drive.

[populistdriven]

23. just open my computer and right click on E: and select properties

it should tell you what UNC path is mapped to that drive (if it is a network drive)

[roseBudd]

25. All I see is G,J, L,N,Q,R,T and of course A,C,D

[populistdriven]

26. I suspect this was deliberate tampering with your PC

But is is possible you got the keylogger from a "bad" website, from an email worm, from an infected download, or even from a worm that is running somewhere on your corporate network. If this is the case then you may also have a Trojan virus in addition to the keylogger.

Also if you have ever purchased anything online with that PC I would cancel or report my credit cards stolen and get new numbers.

If you want the peace of mind that there was nothing else on your PC use xcleaner

[roseBudd]

28. Why me, why so long and why no action? At the very least someone

could say I surf intermittently, something the co. knows about anyways as we all do in my dept. (online)

[populistdriven]

29. Unfortunately, you will probably never know the answer to that question

[BlooInBloo]

8. LOL! Might wanna make sure it's not from the company...

... before doing anything about it....

[mtnester]

9. Kill it if you can

start here or Goggle it with english sites only as a return

http://www.2-spyware.com/remove-klogger.html

[lindisfarne]

12. I'm always suspicious of websites which I don't know which require

me to download an executable.

[roseBudd]

20. It's called kslogger.exe, here is the info on it

ksLogger

Type: Keyloggers
Severity scale: (63 / 100)
It is a relatively simple keylogger that records all user keystrokes and saves them to a file. ksLogger is created mostly for personal use and is not a real parasite. However, it is absolutely free and can be used by hackers for obvious malicious purposes. ksLogger must be manually installed. It runs on every Windows startup.

Related files: kslogger.exe, sys007s.exe, sys007dll.dll

ksLogger manual removal:
Kill processes:
kslogger.exe, sys007s.exe
Help: how to kill malicious processes

Delete registry values:
HKEY_CURRENT_USER\Software\sys007s
Help: how to remove registry entries

Unregister DLLs:
sys007dll.dll
Help: how to unregister malicious DLLs

Delete files:
kslogger.exe, sys007s.exe, sys007dll.dll
Help: how to remove harmful files

Misc:
Logs are stored in x.tmp file located in the root of the main hard disk (C:).

[populistdriven]

15. IMPORTANT!!!

If you suspect corporate espionage is involved you should report this to IT & HR immediately so they can examine the system and try to determine where it came from but ONLY do this if you have nothing to hide.

[roseBudd]

18. I worry about all my Bush bashing on DU, the phone calls to Kerry

headquarters in '04, the phone calls to a known and interviewed by the newspaper Bush protestor.

[MADem]

21. Do you work for the gubmint?

They are looking to do a "closet" drawdown, and are busy finding reasons to fire people. Misuse of computers has become a biggie lately.

[unhappycamper]

17. You should xpost his question in the Computer Help and Support

forum. There's some pretty sharp cookies (punk intended) there.