Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Infected with Keylogger.


  • Please log in to reply

#1
Tayler.

Tayler.

    New Member

  • Member
  • Pip
  • 1 posts
I've run Black Light Scanner, Malwarebytes' Anti-Malware, Spybot S&D and Avast!. They have all come up with nothing so far... The reason I believe I have a key logger is because I have a gaming account and the password keeps getting changed. I do not share my passwords so I have no clue how they are getting my information. I can recover the account but I can't keep it from taking my password. Could someone please guide me in the right direction to locating and removing whatever is doing this? Please and thank you!


The hijackthis report ...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:11:52 PM, on 2/24/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft..../?LinkId=105563
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.c...h...DTP&M=T3616
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O13 - Gopher Prefix:
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-sec...m/ols/fscax.cab
O20 - AppInit_DLLs:
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DJFYEY - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\DJFYEY.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MRXRZU - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\MRXRZU.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: OpcEnum - Unknown owner - C:\Windows\system32\OpcEnum.exe (file missing)
O23 - Service: PVDNSAWDJ - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\PVDNSAWDJ.exe (file missing)
O23 - Service: UI - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\UI.exe (file missing)
O23 - Service: W - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\W.exe (file missing)

--
End of file - 3847 bytes

Also, I'm very curious about a few processes... Maybe you could shed some light on these? And what does (file missing) mean? Does it mean that they are hidden or are simply deleted and left stuff behind.

UI - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\UI.exe (file missing)
W - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\W.exe (file missing)
OpcEnum - Unknown owner - C:\Windows\system32\OpcEnum.exe (file missing)
PVDNSAWDJ - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\PVDNSAWDJ.exe (file missing)
MRXRZU - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\MRXRZU.exe (file missing)
DJFYEY - Unknown owner - C:\Users\EMachine\AppData\Local\Temp\DJFYEY.exe (file missing)

Edited by Tayler., 24 February 2009 - 08:41 PM.

  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP