Removing Perfect Keylogger

[the_site]

I got a Dell PC from an old friend last summer for helping them out.
I never really used it too much just only for Photoshop, Web design, and Internet.

So I finally Found why my Hard drive is so full, Perfect Keylogger was the culprit.
I removed the "dt" folder in system32\dt to help free up my harddrive. Im scanning the hell out of my computer.

Can you guys lend a helping hand share some links to remove Perfect Keylogger from my computer, registry, etc..

also I am wondering what is bpkch.DAT in my system32

[mattblog]

I dont know, i havent tested this, but this might work.

http://www.youtube.com/watch?v=Bdxhk2VMdtU

[Fearghal]

I would recommend going to msconfig and disabling all startup items except your anti-virus. That way, the keylogger should remain inactive to allow an easier removal.

[callumacrae]

Ahaha, this is why I don't use Windows :D

~Callum

[the_site]

@Fearghal: Thanks for your help, but I already did that.
@Alex Mac: Thanks for giving me a little mental note to not use windows, and giving me useless help

[Fearghal]

Have you tried to locate the file in task manager? Then go to view, set columns and check the command line box. Go to the process and copy the command line, thats the pathway to the file. Either delete it or create a deny all ACE.

[the_site]

Checked the Task Manager, I haven't found anything unusual about it. Ill double check.

[Fearghal]

Actually thats a good point, if it was coded by a pro then it will most likely use a negative PID and will not appear in taskmgr.exe.

Use the command line "tasklist".

Actually - New Idea.
Why don't you copy your user profile to an external disk and reinstall the OS? This is the only way to be sure your system is secure after having a breech like that. Its possible that some sort of BDC has now been installed.

One more thing... in cmd type "Net users" to make sure there are no extra user accounts on your system. This is a popular way to keep access to a system, and the account will be marked as "special" in the registry to hide it from all other users.

[the_site]

So the best bet is to reinstall my OS?

[Fearghal]

So the best bet is to reinstall my OS?

I would strongly recommend it. Its the only way to guarantee your security.

Just copy C:\users\YOURUSERNAME to an external disk and once you create a user account with the same username, copy the profile back and merge.

Before you do though, make sure you can read the key from the OS key label. I made the mistake just yesterday of wiping a friends laptop and when I looked to find the key it was unreadable.

If you can't read it, get the magicaljellybean program that reads the key for you