encrypted keyloggers?

olivia · 05-23-2007, 09:41 PM

I have suspected that my partner has had a keylogger on my computer for quite some time now. Not really an issue, except for the particular double standards and the golden rule. At this point, I'd like to find out and get rid of it.

I asked an IT person I know who told me try the basics, see what's running. Run your spyware, blah blah etc. He told me from there try a rootkit revealer.???

None of the basic stuff found anything; I didn't think it would. I'm Jeeeyyyust computer literate enough that my partner would have to find something that wouldn't be found in like, a spybot scan, etc... (not that I'd necessarily know what i was looking at if i saw it, to any real extent.) But most of those, you have to pay for. And unless I'm paying for it and don't know it, (not likely. we're poor.) he's not using any of the free trial stuff that can be found on the internet.

Having too much time on his hands, and plenty of computer brains in his head, it would be not at all a problem for him to put something free and much more complicated for me to find on my lappy while i'm not home.

Before I have to become very conspicuous (by taking the lappy out of the house, which almost never happens) to take it to a professional, is there anything else I can do? I've got the basic idea behind the whole rootkit revealer thing down, however, I where to find/how to use one.

Does anyone have any other suggestions, or advice?

Deliberately changing my passwords, or writing long word documents that tell him I think he's being a butthead, are enough to really irritate him, but not enough to make him admit that he put anything on here.

Thank you in advance for your help.

**johnwill** · 05-24-2007, 09:45 AM

Other than looking for rootkits and other malware, I'm not sure what you can do. You might post a HijackThis log and let the security guys take a look.

Please follow this HJT Log 5 Step Process to post a HijackThis log in the HijackThis Log Help forum here.

olivia · 05-24-2007, 02:34 PM

I was told that using a rootkit revealer would be complicated; I have not yet searched for a rootkit, simply because I'm not sure what all the process would entail. If it's impossible to mess anything up with one, I'll try it. But honestly, I'm not even sure where to find one...

**kinbard** · 05-24-2007, 02:56 PM

AVG has a free (and good) rootkit app. on their site.
http://www.grisoft.com/
Runs like an antivirus program, tell it what type of scan you want to do and let her rip.

olivia · 05-24-2007, 08:52 PM

i'll try it... thank you!

olivia · 05-24-2007, 09:34 PM

I tried the AVG product... no results. I'm going to try posting the hijack this log next...

**Chode** · 05-25-2007, 07:26 PM

I have seen client machines where a partner has installed some kind of monitoring software clandestinely, but I think most of your scans would detect this. Sysinternals RootKit Revealer is easy to use, and should show most keyloggers, etc. even if they are very stealthy. Still,wouldn't it be more appropriate to discuss this with your attorney and a counselor?

olivia · 05-25-2007, 09:01 PM

I would prefer to feel less helpless about it. An attorney or counselor would be mostly moot I think anyway; it would be a live-in boyfriend who would have put it on my computer. The more I know, the more I can take care of myself, and the less likely I am to have stuff like this happen again.

I will certainly try what you have suggested, and thank you. The more I know the better; if there is or was something on this computer, he would know I'm posting to ask about it (I'm assuming) so the more I learn and see the better...

olivia · 05-25-2007, 09:45 PM

Well, I ran the Sysinternals rootkit revealer and this is what it found:

C:\Documents and Settings\Olivia\My Documents\998487-p27.jpg 3/30/2007 9:45 PM 62.92 KB Hidden from Windows API.

There's no way to tell where that came from, is there?

olivia · 05-25-2007, 09:53 PM

??

The file name is just one page of my Dover Clip Art. Why on earth would that show up? (in a rootkit revealer?)

**Cellus** · 05-26-2007, 12:08 AM

Right now the development of rootkit detection for the purposes of finding malicious modification is still hit and miss. While many rootkit detectors can detect specific known-malicious rootkits, a lot of detection is still based on generic detection. As a result detection is not expected to be as fine-tuned and granular as, say, your antivirus. Development has only recently started to kick off, while antivirus has been in development for over a decade.

As Johnwill recommended, go through our HijackThis 5 Step Process and allow someone from our Security Team to check your machine for infection.

05-23-2007, 09:41 PM	#1 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	encrypted keyloggers? I have suspected that my partner has had a keylogger on my computer for quite some time now. Not really an issue, except for the particular double standards and the golden rule. At this point, I'd like to find out and get rid of it. I asked an IT person I know who told me try the basics, see what's running. Run your spyware, blah blah etc. He told me from there try a rootkit revealer.??? None of the basic stuff found anything; I didn't think it would. I'm Jeeeyyyust computer literate enough that my partner would have to find something that wouldn't be found in like, a spybot scan, etc... (not that I'd necessarily know what i was looking at if i saw it, to any real extent.) But most of those, you have to pay for. And unless I'm paying for it and don't know it, (not likely. we're poor.) he's not using any of the free trial stuff that can be found on the internet. Having too much time on his hands, and plenty of computer brains in his head, it would be not at all a problem for him to put something free and much more complicated for me to find on my lappy while i'm not home. Before I have to become very conspicuous (by taking the lappy out of the house, which almost never happens) to take it to a professional, is there anything else I can do? I've got the basic idea behind the whole rootkit revealer thing down, however, I where to find/how to use one. Does anyone have any other suggestions, or advice? Deliberately changing my passwords, or writing long word documents that tell him I think he's being a butthead, are enough to really irritate him, but not enough to make him admit that he put anything on here. Thank you in advance for your help.

05-24-2007, 09:45 AM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,787 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: encrypted keyloggers? Other than looking for rootkits and other malware, I'm not sure what you can do. You might post a HijackThis log and let the security guys take a look. Please follow this HJT Log 5 Step Process to post a HijackThis log in the HijackThis Log Help forum here. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

05-24-2007, 02:34 PM	#3 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	Re: encrypted keyloggers? I was told that using a rootkit revealer would be complicated; I have not yet searched for a rootkit, simply because I'm not sure what all the process would entail. If it's impossible to mess anything up with one, I'll try it. But honestly, I'm not even sure where to find one...

05-24-2007, 02:56 PM	#4 (permalink)
kinbard TSF Enthusiast Join Date: Jun 2006 Location: Texas Posts: 3,459 OS: Experimenter	Re: encrypted keyloggers? AVG has a free (and good) rootkit app. on their site. http://www.grisoft.com/ Runs like an antivirus program, tell it what type of scan you want to do and let her rip. __________________ Half viking, half pirate, stronger than both XP Repair Malware Removal Vista Repair Downgrade Vista

05-24-2007, 08:52 PM	#5 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	Re: encrypted keyloggers? i'll try it... thank you!

05-24-2007, 09:34 PM	#6 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	Re: encrypted keyloggers? I tried the AVG product... no results. I'm going to try posting the hijack this log next...

05-25-2007, 07:26 PM	#7 (permalink)
Chode TSF Enthusiast Join Date: Sep 2006 Posts: 1,280 OS: Windows XP Pro	Re: encrypted keyloggers? I have seen client machines where a partner has installed some kind of monitoring software clandestinely, but I think most of your scans would detect this. Sysinternals RootKit Revealer is easy to use, and should show most keyloggers, etc. even if they are very stealthy. Still,wouldn't it be more appropriate to discuss this with your attorney and a counselor? __________________ Sweet!

05-25-2007, 09:01 PM	#8 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	Re: encrypted keyloggers? I would prefer to feel less helpless about it. An attorney or counselor would be mostly moot I think anyway; it would be a live-in boyfriend who would have put it on my computer. The more I know, the more I can take care of myself, and the less likely I am to have stuff like this happen again. I will certainly try what you have suggested, and thank you. The more I know the better; if there is or was something on this computer, he would know I'm posting to ask about it (I'm assuming) so the more I learn and see the better...

05-25-2007, 09:45 PM	#9 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	Re: encrypted keyloggers? Well, I ran the Sysinternals rootkit revealer and this is what it found: C:\Documents and Settings\Olivia\My Documents\998487-p27.jpg 3/30/2007 9:45 PM 62.92 KB Hidden from Windows API. There's no way to tell where that came from, is there?

05-25-2007, 09:53 PM	#10 (permalink)
olivia Registered User Join Date: Feb 2007 Posts: 64 OS: XP	Re: encrypted keyloggers? ?? The file name is just one page of my Dover Clip Art. Why on earth would that show up? (in a rootkit revealer?)

05-26-2007, 12:08 AM	#11 (permalink)
Cellus Moderator Networking Team Join Date: Aug 2006 Location: Canada Posts: 2,664 OS: Windows Vista Business SP1, Windows XP Professional SP3 My System	Re: encrypted keyloggers? Right now the development of rootkit detection for the purposes of finding malicious modification is still hit and miss. While many rootkit detectors can detect specific known-malicious rootkits, a lot of detection is still based on generic detection. As a result detection is not expected to be as fine-tuned and granular as, say, your antivirus. Development has only recently started to kick off, while antivirus has been in development for over a decade. As Johnwill recommended, go through our HijackThis 5 Step Process and allow someone from our Security Team to check your machine for infection. __________________ TSF Networking Team Virus/Trojan/Spyware Removal Help Donate!