Keylogger:MSIL/Nanocore.BB is a detection name for a specific variant of the NanoCore remote access trojan (RAT) configured with aggressive keylogging and surveillance capabilities. NanoCore has been actively distributed since approximately 2013 and remains one of the most versatile commercial RAT platforms abused by threat actors. This particular variant designation indicates it's written in managed .NET code (MSIL) and exhibits behavior patterns consistent with the BB signature subset, which typically emphasizes credential theft and monitoring rather than destructive payloads.
What makes this threat especially problematic for everyday computer users is its modular design—attackers can enable or disable features like keylogging, screen capture, password recovery, webcam access, and microphone recording depending on their objectives. When the keylogger module is active, every keystroke you type gets silently recorded and transmitted to the attacker, including passwords, credit card numbers, private messages, and sensitive business communications. Unlike ransomware that announces itself immediately, this trojan operates silently in the background for weeks or months, harvesting data while you remain completely unaware.
Threat Profile
| Attribute | Details |
|---|---|
| Threat Family | NanoCore RAT (Remote Access Trojan) |
| Variant Designation | Keylogger:MSIL/Nanocore.BB |
| Common Aliases | MSIL/Nanocore, Trojan.Nanocore, RAT.NanoCore, W32/NanoCore |
| Platform | Windows (all versions); requires .NET Framework 2.0 or higher |
| First Observed | NanoCore family circa 2013; BB variant signatures 2016-present |
| Primary Distribution | Phishing emails with malicious attachments, drive-by downloads, exploit kits, bundled with pirated software |
| Persistence Mechanisms | Registry Run keys, scheduled tasks, startup folder entries, process injection into legitimate Windows processes |
| Core Capabilities | Keystroke logging, password theft, screen capture, file exfiltration, remote desktop control, webcam/microphone surveillance, clipboard monitoring, process manipulation |
| Typical Artifacts | Random-named .exe in %APPDATA% or %LOCALAPPDATA% subdirectories, mutex objects for infection marking, configuration files (often encrypted), network traffic on non-standard ports |
| Network Behavior | C2 communication typically over TCP (custom ports, often 1-65535 range); some variants use dynamic DNS services or encrypted channels |
| Data Exfiltration | Keystroke logs, credentials from browsers/applications, screenshots, file uploads—transmitted to attacker-controlled servers |
| Removal Difficulty | Moderate to high; process injection and multiple persistence points require thorough cleaning; may reinstall if components missed |
How It Spreads
NanoCore variants reach victim computers primarily through social engineering campaigns that exploit human psychology rather than software vulnerabilities. The most common infection vector involves carefully crafted phishing emails that appear to come from legitimate businesses, shipping companies, financial institutions, or even colleagues. These emails contain attachments—often disguised as invoices, shipping notifications, or important documents—that are actually executable files or Office documents with malicious macros. The moment you open the attachment and approve the prompts, the RAT installs silently.
Because NanoCore is sold as a commercial product (originally marketed as a "legitimate remote administration tool" despite its obvious abuse potential), it's widely available to attackers with minimal technical skill. This accessibility has led to its distribution through numerous channels simultaneously. Cybercriminals bundle it with cracked software and key generators downloaded from torrent sites, hide it in fake software updates that appear while browsing compromised websites, and deploy it through exploit kits that target unpatched vulnerabilities in browsers and plugins. Some campaigns have even used infected USB drives and malicious advertisements on legitimate websites.
Common distribution methods include:
- Phishing email attachments — Fake invoices, shipping notifications, tax documents, or resumes in ZIP archives containing executables renamed with double extensions like "Invoice_2024.pdf.exe"
- Malicious Office documents — Word or Excel files with embedded macros that download and execute the trojan when macros are enabled
- Drive-by downloads — Compromised or malicious websites that automatically download the RAT through browser vulnerabilities or fake update prompts
- Software cracks and keygens — Pirated software installers from torrent sites or warez forums that bundle the trojan with otherwise functional programs
- Trojan downloaders — Initial lightweight malware that gains entry through other means, then downloads and installs NanoCore as a secondary payload
- Malvertising campaigns — Malicious advertisements on legitimate websites that redirect to exploit kit landing pages
- Social media links — Shortened URLs shared through Facebook, Twitter, or messaging apps that lead to malicious downloads
What It Does On Your Machine
Once executed, Keylogger:MSIL/Nanocore.BB immediately begins establishing its presence on your system. The initial binary typically extracts itself to a subdirectory in your user profile—commonly within %APPDATA% or %LOCALAPPDATA%—using either a randomly generated folder name or a name designed to blend in with legitimate applications. The malware creates multiple persistence mechanisms simultaneously to ensure it survives reboots: registry Run keys that launch the trojan at every Windows startup, scheduled tasks that trigger at specific intervals or user actions, and sometimes startup folder shortcuts. More sophisticated instances inject their code into legitimate Windows processes like explorer.exe or svchost.exe, making detection significantly harder since the malicious behavior appears to originate from trusted system components.
The keylogging functionality activates immediately and operates at the kernel or low-level hook level, intercepting every keystroke before it reaches the target application. This means it captures passwords you type into login forms, credit card numbers entered on shopping sites, private messages sent through email or chat applications, and even passwords revealed by password managers that use keyboard emulation. The trojan stores these keystroke logs locally in encrypted files before periodically transmitting them to the attacker's command-and-control server. Many NanoCore variants also monitor your clipboard, stealing any data you copy—a technique that captures cryptocurrency wallet addresses, authentication codes, and other sensitive information you might paste rather than type.
Beyond keylogging, this RAT provides attackers with comprehensive remote control capabilities. They can view your screen in real-time, activate your webcam and microphone without indicator lights (on many systems), browse and download files from your hard drive, and execute arbitrary commands with your user privileges. Some victims have reported sudden mouse movements or unexplained windows opening—signs that the attacker was actively controlling the machine. The malware can also harvest saved passwords from browsers, email clients, FTP programs, and other applications, providing instant access to your online accounts even without waiting for keystroke logs.
The trojan maintains constant or periodic communication with its command-and-control server, checking for new instructions and uploading stolen data. This network activity typically occurs on non-standard TCP ports and may use encryption or obfuscation to avoid detection by network monitoring tools. When configured for aggressive data theft, the malware can consume noticeable bandwidth uploading files, screenshots, and logs, though many variants throttle their transmission to remain stealthy. The attacker's objectives determine what happens next—some use the access for financial theft, others harvest credentials for sale on dark web markets, and some maintain long-term surveillance for corporate espionage or personal stalking.
Manual Removal — Step by Step
Disconnect from the Internet Immediately
Before doing anything else, physically disconnect your computer from the internet by unplugging the Ethernet cable or disabling Wi-Fi through the physical switch (not just through Windows settings, which the malware might intercept). This prevents the RAT from receiving commands from the attacker, stops ongoing data exfiltration, and ensures the attacker can't observe your removal attempts or activate destructive countermeasures.
Boot Into Safe Mode with Networking
Restart your computer and boot into Safe Mode with Networking (press F8 during boot on older systems, or use Settings > Update & Security > Recovery > Advanced Startup on Windows 10/11). Safe Mode loads only essential drivers and services, preventing most malware from launching automatically. You'll need the networking component enabled to download scanning tools if you don't already have them. NanoCore variants typically don't run in Safe Mode unless they've achieved extremely sophisticated persistence.
Identify and Terminate Malicious Processes
Open Task Manager (Ctrl+Shift+Esc) and carefully examine all running processes. Look for unfamiliar executables, especially those running from user profile directories (%APPDATA%, %LOCALAPPDATA%, %TEMP%) or with random names. Note that the trojan may inject into legitimate processes like explorer.exe, making this step challenging. If you see suspicious processes consuming network bandwidth or high CPU, right-click and select "End Task" before proceeding. The malware may immediately restart itself through persistence mechanisms, which we'll address in subsequent steps.
Remove Registry Persistence Entries
Press Win+R, type "regedit" and hit Enter to open Registry Editor. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries you don't recognize—NanoCore often creates entries with legitimate-sounding names like "Windows Update Service" or "System Monitor" pointing to executables in suspicious locations. Delete any suspicious entries by right-clicking and selecting Delete. Also check the RunOnce keys in the same locations. Make careful notes of what you remove in case you need to restore legitimate entries later.
Delete Scheduled Tasks
Open Task Scheduler by typing "taskschd.msc" in the Run dialog (Win+R). Expand Task Scheduler Library in the left pane and look through the tasks, especially those under Microsoft > Windows (where malware often hides among legitimate tasks). Look for tasks with suspicious names, unusual triggers (every minute, at logon, etc.), or actions that run executables from user profile directories. Right-click suspicious tasks and select Delete. NanoCore often creates tasks that mimic legitimate Windows maintenance tasks, so compare the action path against known good systems if possible.
Delete Malware Files and Folders
Navigate to the locations where you identified suspicious executables in Step 3. Common locations include C:\Users\[YourName]\AppData\Local\, C:\Users\[YourName]\AppData\Roaming\, and C:\ProgramData\. Look for folders with random GUID names (like {4A8F9C3D-B2E1-4F67-9A8C-3D1E5F7B9C2A}) or names that don't correspond to any software you installed. Delete the entire folder containing the malware executable. If Windows prevents deletion because the file is in use, you may need to boot into Safe Mode again or use a specialized removal tool. Also check your Startup folder at C:\Users\[YourName]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.
Run Comprehensive Anti-Malware Scans
Download and install Malwarebytes (the free version is sufficient for this purpose) from a clean computer if possible, transferring it via USB drive. Run a full system scan—not a quick scan—which will take 30-60 minutes. Malwarebytes has excellent detection rates for NanoCore variants and will identify components you might have missed. After Malwarebytes completes, also run a scan with your existing antivirus if you have one, or download a second-opinion scanner like Kaspersky Virus Removal Tool or ESET Online Scanner. Multiple tools increase the likelihood of complete removal since each has different detection signatures.
Reset Browsers and Clear Credentials
Open each web browser you use and reset it to default settings (this removes extensions, clears cookies, and resets homepage/search settings that might have been modified). In Chrome: Settings > Reset and clean up > Restore settings to original defaults. In Firefox: Help > More troubleshooting information > Refresh Firefox. In Edge: Settings > Reset settings > Restore settings to their default values. This removes any malicious extensions the trojan might have installed for additional monitoring or ad injection purposes.
Change All Passwords From a Clean Device
Because this malware specifically logs keystrokes, you must assume every password you've typed while infected has been compromised. Do NOT change passwords from the infected computer—even after cleaning, residual components might still be active. Use a smartphone, tablet, or known-clean computer to change passwords for email, banking, shopping sites, social media, work accounts, and any other services containing sensitive information. Enable two-factor authentication everywhere possible to provide an additional security layer even if passwords are compromised.
Reboot and Verify System Stability
Restart your computer normally (not in Safe Mode) and observe its behavior carefully over the next few hours. Monitor Task Manager for suspicious processes, check that your startup time is normal, and verify that no unknown programs launch automatically. Run another quick scan with Malwarebytes to confirm nothing reappeared. Check your internet router's connected devices list to ensure no unexpected devices are present (some RAT infections spread to other network machines). If problems persist—frequent crashes, network activity when idle, or processes respawning—the infection may not be fully removed and professional help is recommended.
Prevention
- Never open email attachments from unknown senders, and be extremely suspicious of unexpected attachments even from known contacts whose accounts might be compromised. Verify the legitimacy by calling the sender before opening any executable files, ZIP archives, or Office documents from unexpected sources. Be especially wary of file extensions like .exe, .scr, .bat, .vbs, or double extensions like .pdf.exe that attempt to disguise executables as documents.
- Keep Windows and all software fully updated with the latest security patches. Enable automatic updates for Windows, your browsers, Adobe products, Java, and other commonly targeted applications. Many infections succeed by exploiting known vulnerabilities that have been patched for months or years—updates eliminate these attack vectors.
- Install reputable antivirus software and keep it updated with current definitions. While no antivirus catches everything, quality products (Windows Defender is actually quite capable now, or consider Bitdefender, Kaspersky, or ESET) block most common malware before it executes. Enable real-time protection and don't disable it even temporarily—that's often when infections occur.
- Avoid downloading pirated software, cracks, and keygens from torrent sites or file-sharing services. These are the single most reliable way to get infected with RATs, trojans, and other malware. The "free" software costs far more than legitimate purchases when you factor in data theft, identity fraud, and professional removal services.
- Disable macros in Office documents by default and only enable them for files from sources you absolutely trust and have verified. The vast majority of legitimate documents don't require macros, so any unexpected request to "Enable Content" or "Enable Macros" should be treated as highly suspicious.
- Use a standard user account for daily activities rather than an administrator account. If malware executes under a limited user account, it has restricted ability to install system-wide persistence mechanisms or modify critical system files. Reserve the administrator account for actual administrative tasks like software installation.
- Implement network-level protection through your router's firewall and consider DNS filtering services like OpenDNS or Cloudflare's family-safe DNS that block access to known malicious domains. This provides defense-in-depth—blocking threats before they reach your computer.
- Regularly back up important files to an offline or cloud storage solution that isn't continuously connected to your computer. If you're infected and need to completely wipe and reinstall Windows (sometimes the only way to ensure complete removal), having backups prevents data loss and reduces recovery time.
Bring It In
While the manual removal steps above can work for technically confident users, NanoCore RAT infections present unique challenges that make professional removal worth serious consideration. The malware's process injection capabilities, multiple persistence mechanisms, and potential for reinstalling itself from hidden components mean incomplete removal is common. More importantly, if this trojan has been active on your machine for any length of time, you face serious questions about what data was stolen and which accounts are compromised—questions that require forensic analysis to answer fully. Our technicians at Computer Repair Roswell have the specialized tools and experience to not only remove the infection completely but also assess the scope of compromise and guide you through proper recovery steps.
We're located right here in Roswell, Georgia, and we handle infections like this regularly. Bring your computer to our shop at 1235 Houze Way, Suite D, or give us a call at (770) 695-6835 to discuss your situation. Most RAT removal jobs are completed same-day or within 24 hours, and we'll make sure you understand exactly what happened, what was affected, and how to prevent future infections. We work on both PCs and Macs, serve homeowners and small businesses throughout the Roswell area, and we'll explain everything in plain English—no confusing jargon or upselling services you don't need. Your privacy and security are too important to take chances with incomplete removal attempts.