Last night one of our email accounts began sending spam to many different emails. Since my dad works for a large firm he had their IT support to have a look at on of the emails the account sent. What they said was that one of our computers had probably been infected with a keylogger which has took the login details for the account and was using these to send spam from the account.
There are quite a few computers, phones and tablets which have logged into this account in the past, almost all of which have Avast’s free protection. Because of this uncertainty as to which one of these computers has been compromised I need to run a scan on all of these.
So, what software would you recommend to scan and remove this keylogger on 3 computers and 4 android devices, all of which have Avast installed? Also is there any point in scanning the android devices for malware as they already have Avast installed.
The account is an @btinternet.com account.
One of the computers used to access this account has been infected in the past with some malware, I think it may have been called oneclickdownloader but I can’t remember for sure.
So, what software would you recommend to scan and remove this keylogger on 3 computers and 4 android devices, all of which have Avast installed? Also is there any point in scanning the android devices for malware as they already have Avast installed.Malwarebytes
you find it here http://forum.avast.com/index.php?topic=53253.0 follow the instructions
run in the order listed here, and attach the logs from AdwCleaner / Malwarebytes / OTL here and a removal expert will check the logs for infections
if you have more then one computer you want to check…start With one, when the removers are done With it…then next
if you attach logs from all at the same time it will be chaos
Advent computer adwcleaner log
Advent computer malwarebytes log
Advent computer otl log
Advent computer odt extras log
Advent computer aswMBR log
Is the spam, being sent from a web based e-mail ? I.e. Hotmail, GMail etc ?
According to the email headers the email was sent by YahooMailWebService/0.8.145.547 which I’m guessing is their web-based client. If you want then I could include the attach the header for one of the emails.
Nope, as I feel the web based e-mail was hacked. Have the passwords for that account been changed ?
Yes and that seems to have stopped the emails. The people at my dad’s IT support did say that there could be a keylogger on one of the computers which has took the login details for the account. Would you say that this possibility is also worth checking?
The system I checked looked clean, and as a rule if a web based e-mail is sending out spam then the password was brute forced hacked. This happened to my wife once where her weak password for Hotmail was hacked - she use a stronger one now 
Well I’ll just submit the logs for one more system, if there is a keylogger it’ll probably be on this. The last of the logs will be in my next reply.
Those look OK with no anomalous files
The last log
Again nice and clean
Has the spam stopped ?
Yes it has stopped. Thanks for your help!
Run OTL on each computer and press cleanup to remove it and its associated folders