I found a keylogger on my friends computer. He thinks one of his friends must have installed it while he wasn't there. I found it with Malwarebytes anti malware scanner and removed it. His OS is Windows XP Proffesional.
Is there any log or record that XP keeps of when files or programs were installed? It would be helpful to find out the date and time that this was installed on his PC. Thanks!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Spybot is good. I also like Malwarebytes at http://www.malwarbytes.org
If it is a keylogger it was probably downloaded from the internet
NEXT TIME, do this
find the file
open the location
display hidden folders
edit the .ini or .dll or other file to see where the information is sent.
I ran Super Antispyware and Spybot after finding and removing the keylogger with Malwarebytes. Everything showed clean after I removed it.
It was not listed in the Add/Remove programs list. Malwarebytes said the company was logixoft. I googled it and it looks like this was physically installed on the PC by a human with access to the PC.
Since I already removed the file with Malwarebytes, is there any other way I can trace when it was installed? Any other info I can find out about it? Would the event viewer record this installation, and how can I check?
Ah good idea about slaving the hard disk. Never thought about that, I'll give it a try.
So 2 questions left:
1 - Am I right in assuming there's no real log or easy way to find when files were installed/uninstalled on Windows XP?
2 - Is there any software you can suggest that would run in the background and log all program installations for me? This would be helpful if the person tried to install this again.
>> 1 - Am I right in assuming there's no real log or easy way to find when files were installed/uninstalled on Windows XP?
Yes.
2 - Is there any software you can suggest that would run in the background and log all program installations for me? This would be helpful if the person tried to install this again.
Others can make recommendations on this point.
Best is to restrict access on machine to the administrator account and make users use restricted accounts. This won't stop the spyware being installed but it can only be installed on a restricted account rather than an administrator account.
Business Accounts
Answer for Membership
by: ram_keralaPosted on 2009-10-13 at 22:53:26ID: 25567638
As it is keylogger, before suspecting the friends you need to scan the machine for Sypware with Anitspyware - Spybot is the best among it, download. update and scan.
=====
If you suspected it is installed by someone, depending upon the program installed (unless it is just a single file which is copied to the machine using USB ) and if it listed in Add/ remove programs we will be able to trace it.
=========
Looking on event logs will give you more information
======