MS or Skype account pwd issue - help me check for keyloggers

[Ivo]

Hi all,

my skype sent spam to most of my contacts and after spending some time investigating the issue I found that my account was apparently logged into in locations in the United Kingdom that weren't my doing.

I already changed passwords, but given the above one of my passwords was brute forced, phished, or keylogged. I am most concerned with the last option.

I'm usually careful about this stuff but I'm not going to make the mistake of assuming that I'm perfect and this is some vulnerability on Skype / MS's side.

I don't remember any recent incidents that may have phished me, but sometimes these the attackers wait a lot so I'm not ruling it out.

The only recent issue that I think may have keylogged me was installing EaseUS partition manager, which unfortunately I somehow didn't uncheck the extra junk it came with so it installed some other stuff that I removed ASAP.
I also can't rule out other software installs.

What can I do to be sure that I'm not keylogged in one of the computers I used, apart from fresh Windows installs in 3 or 4 machines I use (ouch)?

Any advice is welcome.

[Ziggy]

https://www.malwarebytes.org/antimalware/

Download and install the free version of Malwarebytes Anti-Malware. After installing, check for updates until it reports there are no updates available. Click on settings at the top, then click Detection and Protection on the left. Under detection options, make sure all of the boxes are checked off (I think rootkits is unchecked by default). At the top, click scan and choose to do a full scan (not a quick scan). Wait until the scan completes. If it finds anything, select to remove. You may have to restart to complete removing malware.



As an aside, one thing that I really like about Norton Security is the ability to check downloads from a community rating. Aside from being able to scan downloads, Norton will check a .exe and such in a community rating which can give you a heads up if it's good or not (or if you accidentally downloaded a fake Flash Player install or the real one).

[bmoc]

Kaspersky TDSSkiller rootkit scanner
Malwarebytes Antimalware
Hitman Pro
Tweaking.com Windows Repair tool

In that order. Those are my go-to's for fixing any malware infections.

[CRTGAMER]

Email without a Cloud that can only be opened to PC sent to. I am in no hurry where I need to see my EMail on every device. May not be an answer to the Key Logger Spyware, but then I simply click a recipient, never have to type in any password.

I hate Norton and Mcafee, both almost as bad as Spyware with constant popups asking for more money upgrade. The very first software I would delete on any new PC purchased.

[Ziggy]

I hate Norton and Mcafee, both almost as bad as Spyware with constant popups asking for more money upgrade. The very first software I would delete on any new PC purchased.

I haven't used McAfee since Win9x, but it sounds like you haven't used Norton in a while. Yes, it was a resource hog for a while. And I too would uninstall it right away on new computers (along with whatever other bloatware). But I've been using Norton for the past two years (currently Norton Security) and it's been great. There are no "constant popups". In fact, there's only two pop ups that you'd ever get: One is a monthly report which is useless, and can be turned off. And two is when your subscription is about to expire, which is a pop up you want. It's also not a resource hog at all. It only uses a few MB in RAM at idle. Even if it's running a full scan or whatever, it uses little resources.

And there's two things I really like about Norton. One, as mentioned above, is the rating system for install files that you download. It's called Norton File Insight. We've all been there. There's some small app that some one made, there's tons of video game related tools out there (patching ROMs, converting save files, emulators, etc). So you download an .exe but you have no way of knowing if it's gonna install some malware along with your neat little app. Well, Norton has a pretty huge community. You might find that your neat little app has thousands of positive hits. Or you might find the opposite, and save yourself some trouble.

And two, their browser plug in. It works in much the same way as File Insight, it uses community ratings, but it also detects any downloads the site might have and checks those too. You Google something and a bunch of random sites pop up that you've never heard of before. Any one of them could have a drive by download or some other attack. Or it might have a download for a neat app that you were searching for, but it's known to be bad and you get a site warning before you even go to download it. The Norton plug in shows site ratings next to hits in search results. It's very useful, and kind of a second net along with IP blocking.

[ExedExes]

In addition to all the antimalware already suggested, I'd give Adwcleaner a try too. I've been using it on every computer that's had issues for about a year and it does a good job clearing out bad stuff.

[Anapan]

ADWCleaner is good and effective.

I prefer Combofix having tried both in succession in different sequence.

http://www.bleepingcomputer.com/download/combofix/

Read about Combofix before using, tho I've never had a big problem with it. It actually orchestrates multiple reboots and jumps in before the login screen to continue it's investigation if any of the known rootkits or keyloggers it detects in-place during it's removal process. It's the closest thing to open-heart surgery you can perform on your computer, and the most powerful tool on my fixer thumbdrive.

It does back everything up studiously, but because of it's power, should something go horribly wrong you need to know how to reverse it's changes from a dos prompt.

Problems are very rare in my experience. Still, there is no better program for removing a rootkit or any other deep-seated virus that I've ever found. It's numbered stages are each a powerful tool or script to detect and remove all the known rootkit and keyloggers methods of infection. Having run it well over 100 times, I can say that it's about 95% effective. The result list makes it so I can manually remove everything it couldn't remove (manual forced deletion at that point because it pointed out results/problems in detailed txt/notepad).
I usually only need to do cleanup at the completion point using CCleaner and a mostly unnecessary final system check.

Give it a try, and if necessary, PM me the resulting text file. It's multi-page list of jargon is easy for me to read, tho IMO shouldn't be posted publicly.