1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

been treatened with key logger?

Discussion in 'Virus & Other Malware Removal' started by angelic wing, Sep 17, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. angelic wing

    angelic wing Thread Starter

    Joined:
    Sep 17, 2004
    Messages:
    5
    Hi guys my first time here :p someone claimed to have placed an key logger thru AIM. im not sure when this happend but we were supposed to be friends. now they say the'll log on to all my accounts etc. ihave full version of spydoctor and i ran it and deleted some files, now it says its clean. but then the hacker's friend says the german key logging program can only be removed by reformatting my computer. what should i do >< how do i know if the key logger might still be here? please help :(

    ooh thanks for reading and helping :D
     
    angelic wing, Sep 17, 2004
    #1
  2. physician

    physician

    Joined:
    Jul 13, 2004
    Messages:
    1,421
    physician, Sep 17, 2004
    #2
  3. angelic wing

    angelic wing Thread Starter

    Joined:
    Sep 17, 2004
    Messages:
    5
    awww mister the program doesnt work >< i have window 98 ^^;;;; thanks for the fast reply :D
     
    angelic wing, Sep 17, 2004
    #3
  4. angelic wing

    angelic wing Thread Starter

    Joined:
    Sep 17, 2004
    Messages:
    5
    help >< ? the guy is still threatening me ;_;
     
    angelic wing, Sep 17, 2004
    #4
  5. angelic wing

    angelic wing Thread Starter

    Joined:
    Sep 17, 2004
    Messages:
    5
    waaa? please help the version doesnt support window 98, what do i download?
     
    angelic wing, Sep 18, 2004
    #5
  6. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,253
    First Name:
    Derek
    Ok we can help easily

    go to http://www.thespykiller.co.uk/files/HijackThis.exe and download 'Hijack This!'.
    make sure it is placed into it's own folder, not a temporary folder. Then doubleclick the Hijackthis.exe.
    Click the "Scan" button, when the scan is finished the scan button will become "Save Log" click that and save the log.
    Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in a reply.
    It will possibly show issues deserving our attention, but most of what it lists will be harmless or even required,
    so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
     
    dvk01, Sep 18, 2004
    #6
  7. angelic wing

    angelic wing Thread Starter

    Joined:
    Sep 17, 2004
    Messages:
    5
    Logfile of HijackThis v1.98.2
    Scan saved at 12:30:00 AM, on 9/18/04
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISUM.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\WINDOWS\SYSTEM\PDESK.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
    C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE
    C:\WINDOWS\SYSTEM\SSDBG.EXE
    C:\PROGRAM FILES\ALWIL SOFTWARE\AVAST4\ASHMAISV.EXE
    C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
    C:\PROGRAM FILES\COMMON FILES\EFAX\HOTTRAY.EXE
    C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\SPYWARE DOCTOR\SPYDOCTOR.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\NMAIN.EXE
    C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\AIM.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\OPERA7\OPERA.EXE
    C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\IAMAPP.EXE
    C:\PROGRAM FILES\NORTON PERSONAL FIREWALL\NISSERV.EXE
    C:\MAY2004\HIJACK\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://aifind.cc/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ultralinks.info/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://bad-url.com/start.php?
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://bad-url.com/start.php?
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://aifind.cc/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://aifind.cc/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aifind.cc/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bad-url.com/start.php?
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://aifind.cc/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 24.112.33.4:8080
    F1 - win.ini: run=C:\WINDOWS\svcinit.exe
    N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.geocities.com/fenrirlancer/darkangel.html"); (C:\Program Files\Netscape\Users\default\prefs.js)
    O1 - Hosts: 216.177.73.139 auto.search.msn.com
    O1 - Hosts: 216.177.73.139 search.netscape.com
    O1 - Hosts: 216.177.73.139 ieautosearch
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_7.DLL (file missing)
    O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINDOWS\SYSTEM\PDesk.exe /Autolaunch
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\PROGRAM FILES\WINAMP\WINAMPa.exe"
    O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
    O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
    O4 - HKLM\..\Run: [Norton eMail Protect] C:\Program Files\Norton AntiVirus\POPROXY.EXE
    O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\Run: [WT GameChannel] C:\Program Files\WildTangent\Apps\GameChannel.exe
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
    O4 - HKLM\..\Run: [couponsandoffers] wjview /cp:p "C:\Program Files\couponsandoffers\System\Code" Main lp: "C:\Program Files\couponsandoffers"
    O4 - HKLM\..\Run: [Online Service] C:\WINDOWS\svchost.exe
    O4 - HKLM\..\Run: [stubport] C:\WINDOWS\SYSTEM\stubport.exe
    O4 - HKLM\..\Run: [Internal] 1
    O4 - HKLM\..\Run: [Control] rundll32.exe C:\WINDOWS\SYSTEM\ctrlpan.dll,Restore ControlPanel
    O4 - HKLM\..\Run: [ssdbg] C:\WINDOWS\SYSTEM\ssdbg.exe
    O4 - HKLM\..\Run: [MsCheckout] C:\WINDOWS\FASTFIND.EXE
    O4 - HKLM\..\Run: [ServicePack1] C:\WINDOWS\SP1UPDATE.EXE
    O4 - HKLM\..\Run: [ashMaiSv] C:\PROGRA~1\ALWILS~1\AVAST4\ashmaisv.exe
    O4 - HKLM\..\Run: [jex] C:\WINDOWS\jex.exe
    O4 - HKLM\..\Run: [000win32] C:\WINDOWS\SYSTEM\restorecrashwin32.bat
    O4 - HKLM\..\Run: [WinLsass] C:\WINDOWS\SERVICEC.EXE
    O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
    O4 - HKLM\..\RunServices: [SVC Service] C:\WINDOWS\SYSTEM\svcinit.exe
    O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O4 - Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exe
    O4 - Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exe
    O4 - Startup: Keylogger Hunter.lnk = C:\Program Files\Keylogger Hunter\KeyloggerHunter.exe
    O8 - Extra context menu item: Coupons - file://C:\Program Files\couponsandoffers\System\Temp\couponsandoffers_script0.htm
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
    O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
    O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\AIM\AIM.EXE
    O12 - Plugin for .mp3: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
    O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
    O16 - DPF: Yahoo! PageBuilder - http://pagebuilder.yahoo.com/members/tools/pagebuilder/prod/client.2.60.18/code/client.cab
    O16 - DPF: ChatSpace Full Java Client 2.0.0.66 - http://cgi.gamefaqs.com/chat/Java/cs4fs066.cab


    k i did what u told me to do, is this right? o_o
     
    angelic wing, Sep 18, 2004
    #7
  8. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,253
    First Name:
    Derek
    You have a lot of rubbish/hijackers/worms/viruses etc
    please print out this so you can refer to it while cleaning

    First download CWshredder from http://www.thespykiller.co.uk and put it on then desktop where you can easily get to it as you will need it very soon

    now uninstall keylogger hunter from add/remove programs as it doesn't work with windows 98

    Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://aifind.cc/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ultralinks.info/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://bad-url.com/start.php?
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://bad-url.com/start.php?
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://aifind.cc/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://aifind.cc/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://aifind.cc/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bad-url.com/start.php?
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://aifind.cc/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s

    F1 - win.ini: run=C:\WINDOWS\svcinit.exe
    O1 - Hosts: 216.177.73.139 auto.search.msn.com
    O1 - Hosts: 216.177.73.139 search.netscape.com
    O1 - Hosts: 216.177.73.139 ieautosearch
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_7.DLL (file missing)
    O3 - Toolbar: My &Search Bar - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - C:\PROGRAM FILES\MYSEARCH\BAR\1.BIN\S4BAR.DLL (file missing)


    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS\SYSTEM\P2P NETWORKING\P2P NETWORKING.EXE /AUTOSTART
    O4 - HKLM\..\Run: [couponsandoffers] wjview /cp "C:\Program Files\couponsandoffers\System\Code" Main lp: "C:\Program Files\couponsandoffers"
    O4 - HKLM\..\Run: [Online Service] C:\WINDOWS\svchost.exe
    O4 - HKLM\..\Run: [stubport] C:\WINDOWS\SYSTEM\stubport.exe
    O4 - HKLM\..\Run: [Internal] 1
    O4 - HKLM\..\Run: [Control] rundll32.exe C:\WINDOWS\SYSTEM\ctrlpan.dll,Restore ControlPanel
    O4 - HKLM\..\Run: [ssdbg] C:\WINDOWS\SYSTEM\ssdbg.exe
    O4 - HKLM\..\Run: [MsCheckout] C:\WINDOWS\FASTFIND.EXE
    O4 - HKLM\..\Run: [ServicePack1] C:\WINDOWS\SP1UPDATE.EXE
    O4 - HKLM\..\Run: [jex] C:\WINDOWS\jex.exe
    O4 - HKLM\..\Run: [000win32] C:\WINDOWS\SYSTEM\restorecrashwin32.bat
    O4 - HKLM\..\Run: [WinLsass] C:\WINDOWS\SERVICEC.EXE

    O4 - HKLM\..\RunServices: [SVC Service] C:\WINDOWS\SYSTEM\svcinit.exe


    O4 - Startup: Keylogger Hunter.lnk = C:\Program Files\Keylogger Hunter\KeyloggerHunter.exe
    O8 - Extra context menu item: Coupons - file://C:\Program Files\couponsandoffers\System\Temp\couponsandoffers_script0.htm


    Now Run CWSHREDDER
    Close all browser windows, click on the cwshredder.exe then click "FIX" (Not "Scan only") and let it do it's thing.

    then
    Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    then as some of the files or folders you need to delete may be hidden do this:
    Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
    Click "Apply" then "OK"

    Delete these files

    C:\WINDOWS\svcinit.exe
    C:\WINDOWS\svchost.exe
    C:\WINDOWS\SYSTEM\stubport.exe
    C:\WINDOWS\SYSTEM\ssdbg.exe
    C:\WINDOWS\FASTFIND.EXE
    C:\WINDOWS\SP1UPDATE.EXE
    C:\WINDOWS\jex.exe
    C:\WINDOWS\SYSTEM\restorecrashwin32.bat
    C:\WINDOWS\SERVICEC.EXE

    and Delete these folders

    C:\PROGRAM FILES\MYSEARCH
    C:\Program Files\couponsandoffers
    C:\WINDOWS\SYSTEM\P2P NETWORKING

    then select EVERYTHING in C:\windows\temp except temporary internet files, cookies and history folders and delete all that as well

    1) Open Control Panel
    2) Click on Internet Options
    3) On the General Tab, in the middle of the screen, click on Delete Files
    4) You may also want to check the box "Delete all offline content"
    5) Click on OK and wait for the hourglass icon to stop after it deletes the temporary internet files
    6) You can now click on Delete Cookies and click OK to delete cookies that websites have placed on your hard drive

    then
    Reboot normally &

    Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

    Spybot - Search & Destroy from http://security.kolla.de
    AdAware SE from http://www.lavasoft.de/support/download

    Run Sybot S&D

    After installing, first press Online, press search for updates, then tick the updates it finds, then press download updates. Beside the download button is a little down pointed arrow, select one of the servers listed. If it doesn't work or you get an error message then try a different server

    Next, close all Internet Explorer and OE windows, press 'Check for Problems', and have SpyBot remove all it finds that is marked in RED.

    then reboot &

    Run ADAWARE

    Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
    the current ref file should read at least SE1R8 13.09.2004 or a higher number/later date
    Then ........
    click the "Scan" button. and select full scan

    When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries. You can safely ignore any MRU entries though and not delete them

    reboot again

    it is vital that you go here, click Scan for updates in the main frame, and download and install all CRITICAL updates recommended.

    then post a new hijackthis log to check what is left
     
    dvk01, Sep 18, 2004
    #8

  9. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - been treatened logger
  1. NumberOneRobot

    New Computer has been freezing a lot lately, possible malware?

    NumberOneRobot, Jan 19, 2020 at 3:11 AM, in forum: Virus & Other Malware Removal
    Replies:
    3
    Views:
    256
    flavallee
    Jan 20, 2020 at 10:55 AM
  2. rimzan

    Solved my computer has been inested with KVAG virus

    rimzan, Nov 30, 2019, in forum: Virus & Other Malware Removal
    Replies:
    24
    Views:
    1,652
    rimzan
    Dec 19, 2019
  3. HaroRider

    In Progress Computer Has Been Acting A Bit Slow

    HaroRider, Jun 1, 2019, in forum: Virus & Other Malware Removal
    Replies:
    21
    Views:
    1,399
    iMacg3
    Jun 22, 2019
  4. TrojanDulla

    New File Types have been converted to .Fordan

    TrojanDulla, May 8, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    632
    Cookiegal
    May 8, 2019
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/275229

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice