Hacked? Keylogger? Someone Has Passwords, Help

Welcome to Major Geeks!

Your logs do not show any problems.

 

You're welcome.

These logs are also not showing any problems.

Not always. It depends on whether the keylogger is one of the commercial/professional types with rootkit/stealth technology. Many times we do see something out of the ordinary though. But we could dig deeper and try the below which runs from the Win 7 Recovery Console and would more likely show something since the scan is running without Windows loaded. Let's see if this method with FRST will still run.

Please do the below so that we can boot to System Recovery Options to run a scan.

For 32-bit (x86) systems download Farbar Recovery Scan Tool and save it to a flash drive.
For 64-bit (x64) systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.


Plug the flashdrive into the infected PC.

Enter System Recovery Options from the Advanced Boot Options:

• Restart the computer.
• As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
• Use the arrow keys to select the Repair your computer menu item.
• Select US as the keyboard language settings, and then click Next.
• Select the operating system you want to repair, and then click Next.
• Select your user account an click Next.

On the System Recovery Options menu you will get the following options:

• Select Command Prompt
• In the command window type in notepad and press Enter.
• The notepad opens. Under File menu select Open.
• Select "Computer" and find your flash drive letter and close the notepad.
• In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter
  Note: Replace letter e with the drive letter of your flash drive.
• The tool will start to run.
• When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) on the flash drive. Please attach this file to your next reply. (See: How to attach)

 

Also lets try running the below even if the above does not run.

Please run the below anti-rootkit tool from Malwarebytes.

• Download Malwarebytes Anti-Rootkit
• If you happened to get a ZIP file version instead of an EXE file then unzip the contents to a folder in a convenient location.
• Open the folder where you saved Malwarebytes Anti-Rootkit to. Now run mbar-1.07.0.1009.exe ( If running Vista, Win7 or Win 8, use right click and Select Run As Administrator )
  • Note: This filename will change as new versions are released, so this is just an example ).
• Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
• Click on the Cleanup button to remove any threats and reboot if prompted to do so.
• Wait while the system shuts down and the cleanup process is performed.
• Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
• If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
  • Internet access
  • Windows Update
  • Windows Firewall
• If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.
• Verify that your system is now functioning normally.

 

Okay run the Malwarebytes Anti-Rootkit instructions first. And then run FRST as below from normal boot mode.

• Double-click FRST.exe to run it. When the tool opens click Yes to disclaimer.
• Press Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your next reply.
• The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Also no issues in any these logs.

 

Perhaps she has the ability to access the PC via Remote Desktop Connection or something similar. You should check is this is enabled. See the below:

https://support.microsoft.com/en-us...0-a5da-7df445788eb9/how-to-use-remote-desktop


http://www.thewindowsclub.com/remote-desktop-connection-windows


If it is not Remote Desktop, how about other applications that could be on your PC. I did see: Citrix XenApp