A little sleuthing?

TrendMicro's Housecall online scanning tool tells me I have an instance of "Spyware_Keyl_PerfectKeylogger" on one of my machines. Googling "Perfect Keylogger", I see that one way it gets installed is along with Limewire, which I know my teenager did install well over a year ago.

Before I let Housecall clean the infection, I would really like to have a look at what's installed, see if I can determine how long it's been there, and whether it's actually been sending out emails about my activities (and if so when and to whom). Can anyone suggest what to look for and where to look for it, to see if I can glean any of this information?

Running WinXP SP2.

TIA!!!

 

If you have a decent firewall installed, chances are that nothing was sent out without you knowing about it. A good firewall intercepts inbound and outbound network traffic and if something strange is taking place, you'd be notified. If all you're running is the basic Windows firewall, it only looks at stuff coming in (and does a fairly weak job of that) so it wouldn't do much to stop something from sending stuff out... I'm not sure if there's a retroactive network activity monitor that can show what's been happening for the past few weeks or months, but there's plenty that you could install now to see if anything strange is going on.

 

Hm. Good point about the firewall. Since ZoneAlarm hasn't raised any alarms, and other scans of various sorts haven't shown anything odd, I am starting to think the TrendMicro scan picked up on some scrap remnants of a previously cleaned-out infection. I'm just gonna run the cleaning step that the scan recommends.

Thanks!