Removing the "Era Hotkeys" Keylogger

[cbk1994]

Post approved by Darlene.

This keylogger has been infecting a lot of people lately, and it's worth posting instructions for removing.

Checking if you have it
If you've opened the "Era Hotkeys" program, or otherwise think you might have it, the easiest way to do it is by clicking "Start", "Run", and typing in "%Temp%". Now, look for a file called "keylog.dat", "keylogd.dat", or "svchost.exe". If it's there, you're most likely infected. If not, you probably aren't, but you may want to try the next few steps just in case.

Confirming you have it
If the last step showed that you are infected, or you still think you may be, there is another, more foolproof step you can take. Download HijackThis, install it, then open it. Click the button that says "Do a system scan and save a logfile".



Once you've scanned, a window should pop up in Notepad looking like this:



Copy everything in the Notepad file, and open up this HijackThis log analyzer. Paste in your logfile, and click "Analyze".



Look through the results. If you see something that looks like this (it may not display the exact message, but it should show up as "nasty"), you have it. If not, you don't.



Removing the keylogger

If you have it, go to the HijackThis results window that should have opened when you did a scan. Find the entry mentioned, check the box, and click "Repair checked items".



Confirm that you want to repair it, and then perform another scan and analyze (using the website posted above) to ensure that your system is now clean.

Empty your temp folder

Now, go to the temp folder again by clicking Start, Run, then typing in "%Temp%".


Close all open programs, including ones in the system tray if possible (AIM, etc), and delete all files in this temp folder.

Restart your computer, and the keylogger will be gone.


Contact me over the forums (forum PM) or in-game if you have questions. Do not post them on the forums.