What other evidence can I obtain regarding this key-logger?

Question

I have a computer that I know has had spyware installed on it (Perfect Key Logger). I have found the location of the key-logger and the date of creation, which is also I think the date of install.

I'm not sure this is the right community to ask this sort of a question in, so please feel free to point me to the appropriate community if it is not.

What other evidence can I obtain regarding this key-logger? Specifically can I get any further granularity on install information? Thus far I am only viewing Properties and Date Created. Perhaps there is a more accurate way to view an install date. Perhaps there is even a way to link it to some purchase data. Something confirming that it was downloaded while on a particular IP address would be great.

As a note I am viewing the files, via SATA to USB from a Windows 8 computer. I work with Linux as well, in case the UNIX terminal offers more granularity regarding this information.

Here is a link to the key-logger product, it is from a company named "Blazing Tools". http://www.blazingtools.com/bpk.html

Any comments or suggestions will be appreciated.

Answer 1

You can look in the events logs for looking for entries which describe the date of the eventual installation of the keylogger. For your research, you can search around the created/modified date of the file.

If you want to know how this malware has been downloaded or copied on your harddrive, you can look the history of yous web browsers and in the registry to know which USB-key has maybe been plugged on your system.

If nothing of all of that helps you, youcan search all files has been modified at the same date of the keylogger, maybe it will help you to find and understand the process of his execution.

Good luck for yours investigations.