About Logmein

LogMeIn is a commercial RAT program also known as RemoteAnywhere.

Removal Instructions

Automatic Removal:

Logmein can be detected and removed Automatically by SpyEraser.

Manual Removal:

Follow these steps to remove Logmein from your machine. Begin by backing up your registry and your system, and/or setting a Restore Point, to prevent trouble if you make a mistake.

1. Kill these running processes with Task Manager:
   ra16app.exe
   raabout.exe
   ramaint.exe
   rainst.exe
   zip.exe
   logmeinsystray.exe
   logmein.exe
   openssl.exe
   ra_sc.exe
   ra_reboot.exe
    
2. Unregister these DLLs with Regsvr32, then reboot:
   sqlite3.dll
   rulsrv.dll
   rpt.dll
   uadaily.dll
   ua27212.dll
   ua27201.dll
   unpepack.dll
   unpacks2.dll
   unpacks.dll
   unpack.dll
   unmime.dll
   unamscan.dll
   unadbx.dll
   winpgi.dll
    
3. Remove these registry items (if present) with RegEdit:
   HKEY_CLASSES_ROOT\appid\logmein.exe appid
   HKEY_CLASSES_ROOT\clsid\{33d9a760-90c8-11d0-bd43-00a0c911ce86}\instance\logmein video encoder
   HKEY_CLASSES_ROOT\logmein.guestinvite
   HKEY_CLASSES_ROOT\logmein.guestinvite.1
   HKEY_CURRENT_USER\software\logmein
   HKEY_LOCAL_MACHINE\software\logmein
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit asynchronous
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit dllname
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit impersonate
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit lock
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit logoff
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit logon
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit shutdown
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit startscreensaver
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit startshell
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit startup
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit stopscreensaver
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\lmiinit unlock
   HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\specialaccounts\userlist logmeinremoteuser
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\folders c:\program files\logmein\
   HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\{fcd06104-
   04f6-45aa-886b-0fb75c7eed3d}
   HKEY_LOCAL_MACHINE\system\currentcontrolset\control\print\environments\windows nt x86\drivers\version-3\logmein printer driver
   Registry management is too hard? Download Registry Mechanic to help you!
    
4. Remove the following folder in Explorer if exists:
   ProgramFiles+\logmein

SpyEraser can automatically remove the trojan. Even if you remove it manually, we recommend you should use SpyEraser to make sure it's completely removed from your system and will not be reinstalled by itself.

Download the last version of SpyEraser to protect your system.

Removal Instructions for Other Trojans