Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Concern about KeyLogger. Firewall?

08 Jul 2012   #1

Windows 7
 
 
Concern about KeyLogger. Firewall?

Somebody has been logging into my spare laptop. It's my personal laptop i keep at my business. I've noticed it in web history and i've been getting viruses. I can change the pw, but would rather not.

I'd like to install "Free Keylogger" Free Keylogger - CNET Download.com

with 10k+ downloads and over 100 reviews and on cnet and reviewed by cnet would you thnk this application is safe?

1. How can I be sure this software is safe and won't send my sensitive information over the net back to some DB? I can see the logger records my passwords to it's logs.

2. Its a simple program. To feel safer I added a inbound and outbound firewall rules on my laptop (windows 7) to stop traffic from the one program. Does this help? Is this enough. Can the program still send data if these firewall rules are in place?

3. I have a new Cisco router 4500 I think with Cisco Cloud. Any way I can stop all non 80/443 traffic FROM/TO the device? Not sure how I can do this with the router.

My System SpecsSystem Spec
.

08 Jul 2012   #2

MS Windows 7 Ultimate SP1 64-bit
 
 

Quote   Quote: Originally Posted by cyberpine View Post
Somebody has been logging into my spare laptop. It's my personal laptop i keep at my business. I've noticed it in web history and i've been getting viruses. I can change the pw, but would rather not.
CHANGF THE PASSWORD!

I'd like to install "Free Keylogger" Free Keylogger - CNET Download.com
with 10k+ downloads and over 100 reviews and on cnet and reviewed by cnet would you thnk this application is safe?
NO! Will get you nothing but trouble and poor performance.

1. How can I be sure this software is safe and won't send my sensitive information over the net back to some DB? I can see the logger records my passwords to it's logs.

2. Its a simple program. To feel safer I added a inbound and outbound firewall rules on my laptop (windows 7) to stop traffic from the one program. Does this help? Is this enough. Can the program still send data if these firewall rules are in place?
EXCELLENT! If that's the only offending program, then you should have no problems.

3. I have a new Cisco router 4500 I think with Cisco Cloud. Any way I can stop all non 80/443 traffic FROM/TO the device? Not sure how I can do this with the router.
No experience. Someone else will need to guide you on this one.
Since you are infected, then to have a clean system you must run Windows Defender Offline which is NOT Windows Defender as you know it.

Here is the procedure and info you need:
HOW TO USE WINDOWS DEFENDER OFFLINE ON A USB STICK
Windows Defender Offline
· is a free standalone, bootable malware and virus remover from Microsoft.
· performs an offline scan of an infected PC to remove viruses, rootkits and other advanced malware.

Download Windows Defender Offline (about 764 kB)

You will have the choice of downloading the 32bit version (x86) or the 64 bit version (x64).
The link will help you determine whether you are running a 32 bit version or 64 bit version of Windows

NOTE!! You can download and prepare a 32 bit version using a 64 bit version of Windows
NOTE!! You can download and prepare a 64 bit version using a 32bit version of Windows.

You run the 32 bit version on a 32 bit version of Windows.
You run the 64 bit version on a 64 bit version of Windows.

The 32 bit download file name is: mssstool32.exe
The 64 bit download file name is: mssstool64.exe

For the curious, this program was originally name Microsoft Standalone System Sweeper.


INSTALLATION:
You will need an Internet Connection.
Insert 512 mB (Microsoft’s 256 mB is no longer accurate) or larger USB stick into a usb port.
Run the downloaded program--mssstool64.exe or mssstool32.exe
NEXT button
Choose the option On a USB flash drive that is not password protected
NEXT button
NEXT button
.
The install program will format the usb stick using the NTFS format.
The install program will download about 210 mB.
The install program will name the USB stick WDO_Media32 or WDO_Media64
The WDO_Media32 usb stick will have used space of 255 mB (268,140,544 bytes)
The WDO_Media64 usb stick will have used space of 282 mB (296,165,376 bytes)
You can expect the number of mB to increase as more malware appears.

UPDATE Windows Defender Offline USB stick:
· reinsert the usb stick
· run the installation program, mssstool64.exe or mssstool32.exe, again.
· the update will download about 66 mB (mssstool32.exe) and 68 mB (mssstool64.exe).

Since the malware database is sometimes updated several times in a day, always update before running.

PERFORM AN OFFLINE SCAN
Bootup your computer from the USB stick
Windows Defender Offline will automatically perform a quick scan.
After the quick scan finishes, Choose Full Scan
Select all of your drives

The initial, full scan can easily take several hours, but
Remember, your computer is being very thoroughly checked for all types of malware.


RESULTS OF THE SCAN
The results will be in 4 log files on your computer's disk in:
\Windows\Microsoft Antimalware\Support

==============================================
==============================================

After running WDO, then carry out following and upload the resulting .ZIP file.

I'll await the ZIP file before I proceed.

Script:
# ************************************************************
# Zips up your log files from Windows Defender Offline
#  and extended info about the log files
# Places WDOlogs.ZIP on your Desktop
#
# **********************INSTRUCTIONS**************************
# STEP 1 *****************************************************
# RUN PowerShell as administrator
# START ORB | type POWERSHELL | CTRL+SHIFT+ENTER key combo | ALT+Y keycombo
# ************************************************************
# STEP 2 *****************************************************
# COPY, using CTRL+C, every line down thru both EXIT statements 
# PASTE into Powershell == Right-Click at the PowerShell Prompt
#  (Ctrl+V does not work)
# Start copying with first line without a # at start of the line
# Note: Actually, you can paste the entire file if you rather
#       Lines starting with a # are ignored by PowerShell
# ************************************************************
#functions

function New-Zip {
    
param([Parameter(Mandatory=$truePosition=0ValueFromPipeline=$true)]
    [
String$Path, [Switch] $PassThru, [Switch] $Force )
    
Process { if (Test-Path $path) {if (-not $Force) { return } }
    
Set-Content $path ("PK" + [char]+ [char]+ ("$([char]0)" 18))
    
$item Get-Item $path$item.IsReadOnly $false;if ($passThru) { $item } } }
function 
Copy-ToZip {param(
  [
Parameter(Mandatory=$true,Position=0,ValueFromPipelineByPropertyName=$true)] [Alias('FullName')] 
  [
String]$File, [Parameter(Mandatory=$true,Position=1)] [String]$ZipFile,[Switch]$HideProgress,[Switch]$Force )
  
Begin {$ShellApplication = New-Object -ComObject Shell.Application
  
if (-not (Test-Path $ZipFile)) {New-Zip $ZipFile};$Path Resolve-Path $ZipFile
  $ZipPackage 
=$ShellApplication.Namespace("$Path")}
  
Process {$RealFile Get-Item $File; if (-not $RealFile) { return }        
  if (-
not $hideProgress) {$perc +=5; if ($perc -gt 100) { $perc 
    
Write-Progress "Copying to $ZipFile$RealFile.FullName -PercentComplete $perc}
  
$Flags 0; if ($force) {$flags 16 -bor 1024 -bor 64 -bor 512};Write-Verbose $realFile.Fullname
   $ZipPackage
.CopyHere($realFile.Fullname$flags);Start-Sleep -Milliseconds 500}}

$fileinfo join-path $env:TEMP \wdofileinfo.txt
IF (test-path $fileinfo) {del $fileinfo -ea:silentlycontinue -force:$true}
$dir $env:windir '\Microsoft Antimalware\Support'
$a dir $dir  -rec -force -ea:silentlycontinue sort-object -property lastwritetime 
$b 
$a where {$_.extension -eq '.log'} |Select  modefullnamenamecreationtimelastwritetime,  lastaccesstimelengthextension
$b 
out-file -append $fileinfo
$b 
| foreach ($_.fullname) {get-content -path $_.fullname} | out-file -append $fileinfo 
$ziploc 
$env:userprofile '\desktop\WDOlogs.ZIP'
new-zip $ziploc -verbose:$false -ea:silentlycontinue -force:$true
copy
-tozip  $fileinfo $ziploc -verbose:$false -hideprogress:$true
del $fileinfo

EXIT
EXIT

# ***************** NOTE - POWERSHELL VERSION*****************
# if you receive this error msg:
#  Get-WinEvent: The system can not find the path specified
# you need to update your PowerShell
# you must be using Powershell 2.0 or later.
#
# To determine your Powershell version:
#   Run PowerShell
#   enter $host.version
#   you should see at least:
# Major  Minor  Build  Revision
# -----  -----  -----  --------
# 2      0      -1     -1
#
# If you do not see the above, update your Vista/Win 7.
# ************************************************************
# *************** NOTE - EXECUTION POLICY*********************
# If you haven't set the execution policy, you may need to:
#   Run PowerShell
#   enter Set-ExecutionPolicy -executionpolicy remotesigned
#
# ************************************************************ 
==================================================
karl
My System SpecsSystem Spec
08 Jul 2012   #3

Windows 7 Home Premium x32 SP1
 
 

Quote   Quote: Originally Posted by cyberpine View Post
(...)

1. How can I be sure this software is safe and won't send my sensitive information over the net back to some DB? I can see the logger records my passwords to it's logs.

2. Its a simple program. To feel safer I added a inbound and outbound firewall rules on my laptop (windows 7) to stop traffic from the one program. Does this help? Is this enough. Can the program still send data if these firewall rules are in place?

3. I have a new Cisco router 4500 I think with Cisco Cloud. Any way I can stop all non 80/443 traffic FROM/TO the device? Not sure how I can do this with the router.
Ad.1
Firewall with outbound protection will be helpfull in this case - will tell you when any app will try to connect to the Internet. Unfortunately built-in Windows 7 outbound FW does not support a popup notifications which asks you about outbound connections.
However there are few "addons" for this almost perfect FW:
- Windows 7 Firewall Control
- Windows Firewall Notifier

Ad.2
Yes. It will help.
For future reference please see how to create rules in Windows Firewall.

Ad.3
No, it's not good idea.
Windows needs other than only 80/443 ports open.
Keep in mind there are services like eg. svchost (few instances), DNS/DCHP or SSDPSRV, etc
They need specific port open for proper work or download Windows updates.
My System SpecsSystem Spec
.


08 Jul 2012   #4

Windows 7 Ultimate x64
 
 

Quote   Quote: Originally Posted by cyberpine View Post
I can change the pw, but would rather not.
You really need to change your password. If someone sneaked in with your current password, no matter what you do, he will be able to do it again and you're lost again. Changing a password is the No 1 security measures once someone breaks into.

Quote   Quote: Originally Posted by cyberpine View Post
I'd like to install "Free Keylogger" Free Keylogger - CNET Download.com
1. How can I be sure this software is safe and won't send my sensitive information over the net back to some DB? I can see the logger records my passwords to it's logs.
Don't know it really, but reading a lot of reviews and by trial and error is the best way of figuring out. But to prevent anything, a firewall rule to block all outgoing traffic from that program will effectively prevent any suspicious activity.

Quote   Quote: Originally Posted by cyberpine View Post
2. Its a simple program. To feel safer I added a inbound and outbound firewall rules on my laptop (windows 7) to stop traffic from the one program. Does this help? Is this enough. Can the program still send data if these firewall rules are in place?
It will be enough to prevent IT from sending anything. But keep in mind that there are a few workarounds and if it really is a spyware it might use another program as a carrier for the data (sounds a little crazy and paranoid, I know, but it's technically possible). Most times by firewallying it for both inbound and outbound connections you're safe.

Quote   Quote: Originally Posted by cyberpine View Post
3. I have a new Cisco router 4500 I think with Cisco Cloud. Any way I can stop all non 80/443 traffic FROM/TO the device? Not sure how I can do this with the router.
Not sure with that router, but I see that it's a BAD idea anyway. Some services really needs ports outside the web basics, say, email clients, msn, torrents, games, ftp clients, all needs other ports, to say some. My thinking is that a good software firewall is enough, configured to reject everything except those programs/ports that you explicitly know about.
My System SpecsSystem Spec
08 Jul 2012   #5

Windows 7 Pro. 64/SP-1
 
 

Did you do what karl recommended in post # 2? IMO have a clean computer and a new password should be first.
My System SpecsSystem Spec
28 Sep 2012   #6

mac os
 
 

Quote   Quote: Originally Posted by cyberpine View Post
Somebody has been logging into my spare laptop. It's my personal laptop i keep at my business. I've noticed it in web history and i've been getting viruses. I can change the pw, but would rather not.

I'd like to install "Free Keylogger" Free Keylogger - CNET Download.com

with 10k+ downloads and over 100 reviews and on cnet and reviewed by cnet would you thnk this application is safe?

1. How can I be sure this software is safe and won't send my sensitive information over the net back to some DB? I can see the logger records my passwords to it's logs.

2. Its a simple program. To feel safer I added a inbound and outbound firewall rules on my laptop (windows 7) to stop traffic from the one program. Does this help? Is this enough. Can the program still send data if these firewall rules are in place?

3. I have a new Cisco router 4500 I think with Cisco Cloud. Any way I can stop all non 80/443 traffic FROM/TO the device? Not sure how I can do this with the router.
Free keyloggers are not safe to use. They may be bind to virus or spyware which harms your computer. I'm using Microkeylogger and it works great.
Tips:
1. Make sure to use the keylogger in a legitimate manner
2. Choose keylogger from decent vendors with excellent customer support
My System SpecsSystem Spec
Reply

 Concern about KeyLogger. Firewall?




Thread Tools



Similar help and support threads for2: Concern about KeyLogger. Firewall?
Thread Forum
Concern About Latest Updates Windows Updates & Activation
Solved Windows 7 Concern General Discussion
Memory Clock Concern Hardware & Devices
new on this ... up for questions/concern? Software
Windows 7 Memory Concern Performance & Maintenance
Free Windows 7 Upgrade Concern (VOID concern) General Discussion

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 05:58 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33