View Single Post
  #6  
Old December 31st 07, 11:49 PM posted to microsoft.public.outlook
Milly Staples [MVP - Outlook][_2_]
external usenet poster
 
Posts: 1,219
Default Possible spyware/keylogger in outlook

Additionally, I would inquire of my family members who have access to your computer what they had in mind when installing this piece of spyware. Sounds like there may be a trust issue there.

See http://www.spywareremove.com/removeFamilyKeyLogger.html for how to thoroughly remove this.

Then password protect your computer with a screensaver you can kick in automatically when you leave your computer and set a password on it.

I have created a simple shortcut to lock my computer when I leave it at work - no need to use it at home, cats don't have access to my desktop, they have their own laptops!) - then drag it to your quick launch bar:

%windir%\system32\rundll32.exe user32.dll,LockWorkStation

Works on Windows XP, not sure about Windows Vista.

--
Milly Staples [MVP - Outlook]

Post all replies to the group to keep the discussion intact. All
unsolicited mail sent to my personal account will be deleted without
reading.

After furious head scratching, Peter Nolan asked:

| On Dec 30, 11:00 am, "VanguardLH" wrote:
|| "Peter Nolan" wrote in message
||
|| ...
||
||| I am using outlook xp on win xp dell laptop...
||
||| When I sent emails out I am occasionally seeing 'sending 0 of n'
||| emails.
||
||| This usually only occurs when sending acknowledgements for emails
||| and
||| in these cases there are no acknowledgments......
||
|| snip
||
|| I never send (automatically or via prompt) any read receipts so this
|| is a just a guess that Outlook doesn't count read receipts since YOU
|| didn't compose them. I wasn't aware that Outlook even gave you any
|| notification that it was sending a read receipt.
||
|| Do you have Outlook configured to automatically send read receipts
|| (when any senders requests them)? One of the first configuration
|| changes or checks you should do after installing Outlook is to ensure
|| that you neither automatically send read receipts or even bother with
|| the prompts for them. Set Outlook to *never* send read receipts.
|
| Hi All,
| more on this one...
|
| 1. No..there is nothing in the sent items for the 0 of n emails being
| sent....does anyone know how to track what emails are being sent
| especially these 0 of 1? Can the tcp port be logged to see what is
| going over it? Or can Outlook be made to log in more detail?
|
|
| 2. The directory that the spyware is in is "F:\Documents and Settings
| \Peter Nolan\Local Settings\Temp\AAWTMP\C658777" and it is
| familykeyloggersetup.exe..
|
| Interestingly, if I open this folder in exlporer the name of the
| subfolder keeps changing. I guess this is it's attempt to hide...
|
| 3. I have a dual boot machine so I booted the other OS opened outlook
| there and scanned using ad aware and ad aware + mcafee found the key
| logger again, this time on the C drive....So it would seem to me that
| the spyware is somehow attached to the outlook folder because the
| instance of outlook was completely separate. Does anyone know how to
| look for what programs are loaded when outlook starts up? Is there
| a .ini file or something? I would think the spyware must be attached
| to the startup of outlook via the folder that held the original bugged
| email.
|
| "If you have all windows and office updates and do not open blocked
| attachments and do not visit questionable, untrusted websites and use
| the
| default security settings (or tighten them), you should be ok. "
|
| I gather that I have received an email that had the bug in it.....they
| have done a pretty good job since they avoided mcafee on the way
| in...though mcafee finds it when scanned by ad aware....it is
| interesting to note that mcafee does NOT find it if it is run by
| itself....probably because of the changing folder name.......
|
| 4. I have not yet figured out how to make sure I can get rid of it so
| no credit card numbers getting typed into this laptop any time
| soon.....
|
| All ideas most welcome....
|
| I will also post to the mcafee site.
|
| Thanks
|
| Peter
Ads
 

Loans - 0 Credit Cards - Compare - Credit Cards UK - Handytest