Scammers prefer to use this keylogger because of its ease of configuration, and flexability of use, its packed with features. Here are removal instructions for Perf Keylogger.
(Source Webpage for removal:
)
Quote:
|
Perfect Keylogger is a complex commercial keylogger with rich functionality. It records all user keystrokes including passwords, takes screenshots, tracks user activity in the Internet, captures chat conversations and e-mail messages. Perfect Keylogger can be remotely controlled. It can send gathered data to a configurable e-mail address or upload it on a predefined FTP server. The keylogger must be manually installed. It runs on every Windows startup.
|
(Note: Perf keylogger can be configured to install automatically, and this is what scammers tend to do, unless they are noobs).
Quote:
Perfect Keylogger properties:
• Allows remote user connection
• Takes and sends out screenshots of user activity
• Sends out logs by FTP or email
• Logs keystrokes
• Hides from the user
• Stays resident in background
|
Quote:
Perfect Keylogger manual removal:
Kill processes:
setup.exe, bpk.exe, i_bpk[XVS].exe, lview.exe, wsy.exe
|
(press ctrl+alt+del to access the process manager, you can kill the processes from there. If the processes are hidden, try an alternate process manager, such as "Process Viewer"(google it)).
Quote:
Delete registry values:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVe rsionRunBPK
HKEY_CURRENT_USERSoftwareBlazing ToolsPerfect Keylogger
HKEY_CURRENT_USERSS.SS
HKEY_CURRENT_USERSS.SS.1
HKEY_CURRENT_USERCLSID{1D1B2879-99FF-11E3-8D96-D7ACAC95952A}
HKEY_CURRENT_USERInterface{1D1B2878-99FF-11E3-8D96-D7ACAC95952A}
HKEY_CURRENT_USERTypeLib{1D1B286C-99FF-11E3-8D96-D7ACAC95952A}
HKEY_LOCAL_MACHINESOFTWAREBlazing ToolsPerfect Keylogger
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionUninstallPerfect Keylogger [XVS]
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentV ersionExplorerBrowser Helper Objects
{1D1B2879-99FF-11E3-8D96-D7ACAC95952A}
|
(To access your registry, the fastest way is to goto start>run, type in "regedit" (no quotes) and press Enter. Or, you can also find it under admin. tools, if the menu is enabled in your'e start menu).
Quote:
Delete files:
setup.exe, bpk.exe, i_bpk[XVS].exe, lview.exe, wsy.exe, bsdhooks.dll
|
(The best way to delete these files is to find them using Start>Find and search for all files and folders on the systems master drive, usually C: ).
Quote:
Delete directories:
C:Program FilesPerfect Keylogger [XVS]
C:Program FilesBlazing ToolsPerfect Keylogger
C:'Documents and SettingsAdministratorStart MenuProgramsPerfect Keylogger [XVS]
Misc:
[XVS] is the version number or name.
|
(Open "MyComputer", find the directories and delete them).
Quote:
|
Perfect Keylogger may use files with random names. The program may create all listed objects or add only few of them. Perfect Keylogger functionality may differ depending on the version.
|
(This is a generalized quote off the website this guide is copied from. Perf Keylogger does not use random names. However, it may not use all listed objects as stated, meaning you may not have to delete everything listed depending on the version you are infected with).
