Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that a keylogger had been installed in my girlfriend computer, what is the best way to find it? how do I get the email address that the keylogger is addressing the information?

share|improve this question

migrated from Aug 6 '12 at 6:10

This question came from our site for professional and enthusiast programmers.

"what is the best way to find it?" a malware scanner? – vcsjones Aug 3 '12 at 21:52
@vcsjones Oh, I suppose he doesn't know... maybe that's why he asked the question. – cutrightjm Aug 28 '12 at 1:41

You can probably remove the keylogger, but unless it's really amateur software, I wouldn't bet on finding out the email address the alerts are going to, as it most likely sends that information securely, and the program is most likely hidden.

As a precaution, backup any important data and run the following programs:

  1. Rkill - it will close any active malicious software (and hopefully your keylogger). The log may also give you a hint as to what specific program you are fighting.

  2. TDSS Killer - checks for any rootkits that would hide the keylogger from showing up in windows.

  3. Combofix - Constantly updated removal program that is trained to remove an array of malware. This software is really powerful but can also get messed up if you're badly infected. Like I said, backup your data first.

  4. Kaspersky Anti-virus - Download the trial and run a deep scan. I seem to remember it being pretty decent at finding keyloggers.

  5. Malwarebytes - Run full scan. Can catch stuff that a lot of commercial antiviruses miss.

  6. HitmanPro - Download the free version and scan. Catches stuff everyone else misses.

It's a lot of scans but hopefully the first three scanners remove it all and the rest is just extra assurance. If you still think you're infected, run HiJackThis and post the logfile here. It will list all startup items and services.

-Good luck and happy hunting!

share|improve this answer

open task manager and try to identify unknown running process.

share|improve this answer

Best chance you have is to download some software build to find keyloggers. Most keyloggers run in stealth mode, and thus dont show up much of anywhere.

share|improve this answer

You must log in to answer this question.