Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Keylogger Virus named image2872

03 Jul 2013   #1

windows 7 Home Premium 64bit
Keylogger Virus named image2872

Unfortunately I have a virus/keylogger on my computer it goes under the name I have given in the title. When I come to delete it in my appdata folder it keeps reappearing. I have used malwarebytes and other anti virus programs and some help would be much appreciated to remove this annoying thing.

My System SpecsSystem Spec
03 Jul 2013   #2

W7 Pro SP1 64bit

Welcome to the Seven Forums.

One of the trained security experts should be along to help you. In the mean time, you might want to scan your computer using WDO: What is Windows Defender Offline?
My System SpecsSystem Spec
03 Jul 2013   #3

Windows 7 Home Premium


Just curious...can you tell us how you arrived at the conclusion that a Keylogger is installed on the system by the name image2872?

Please start the computer, and tap the F8 key before the Windows logo appears.
When you get the Advanced Boot Options screen, use the arrow keys to highlight Safe Mode with Networking, and then press: Enter

Next, please use RKill.exe to terminate malware processes:
Save to the Desktop.

If RKill.exe does not run, then download and try to run

You only need to get one of the versions of RKill to run.

There are additional versions:

Also, RKill, renamed, can be downloaded from the following links:

If your AntiVirus warns you about this tool, ignore the warning, or temporarily disable your AntiVirus.

Right-click on the downloaded RKill file and select: Run as Administrator

A black DOS box briefly flashes and then disappear. This is normal and indicates the tool ran successfully.
After running the tool, do not reboot.

When the scan is done Notepad opens with the RKill report.

Please post the RKill report in your reply.

Without a reboot, please Download RogueKiller (Official website)
Select the x64 version download.
Save to the Desktop.

Close all windows and browsers.
Right-click and select: Run as Administrator

At the program console, wait for the prescan to finish. (Under Status, it says: Prescan finished.)

Press: SCAN

When done, a report opens on the Desktop: RKreport.txt
Please provide the RKreport.txt (Mode: Scan) in your reply.
My System SpecsSystem Spec


 Keylogger Virus named image2872

Thread Tools

Similar help and support threads
Thread Forum
A FOLDER APPEAR named "Tempo" with a subfolder named "Lexicons"
HI TO ALL OF YOU OUT THERE i'm new to this forum, i hope you guys can help me out. A folder named "Tempo" with a subfolder named "Lexicons" created and reappear in my "E" Drive. i deleted it but it kept on reappearing after i revisit that drive. tried deleting it from CMD PROMPT with...
General Discussion
Large file named 'Rootkit' scanned with anti-virus. 4 boot records
Hi So today I was running a quick scan with my anti-virus/malware software (Bt Netprotect + in association with McAfee) and happened to glance at the screen to see this: The file being scanned was labelled Rootkit The quick scan was 99% complete 0 issues had been detected 0 issues has...
System Security
BSOD after removing a virus named scan antivirus
hi guys got another bsod while posting this message all have started after removing a virus named scanner antivirus or similar if someone can help thank you
BSOD Help and Support
Best option for removing a keylogger virus
Hi, I don't want to take any chances with this. Would using the clean command twice be enough, or should I go so far as to use clean all? Other options? The system in question is a netbook with windows 7 started on it. Thanks
System Security
Germany named Europe's top computer virus culprit
Germany named Europe's top computer virus culprit - The Local

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 16:22.
Twitter Facebook Google+