|
|
||
11-19-2006, 10:31 AM
|
#1 (permalink) |
|
Diamond Member
 
Join Date: Jun 2005
Location: Computer Engineering @ NCSU
Posts: 1,271
|
Possible keyloggers; VIP! Help immediately!
I was playing WOW and there was a portal to Darnassus in Ironforge that I clicked. I clicked it several times, and nothing happened. Later tonight I was disconnected from my character twice. When I regained control of my character, all of my equipment had been stolen as well as my money.
Be on the lookout for anything that would have aided in my password being stolen... Thanks! Logfile of HijackThis v1.99.1 Scan saved at 5:29:25 AM, on 11/19/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\SYSTEM32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\LEXBCES.EXE D:\WINDOWS\system32\spoolsv.exe D:\WINDOWS\system32\LEXPPS.EXE D:\WINDOWS\Explorer.EXE D:\WINDOWS\System32\nvraidservice.exe D:\Program Files\Microsoft IntelliType Pro\type32.exe D:\Program Files\Logitech\MouseWare\system\em_exec.exe D:\WINDOWS\system32\ctfmon.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe D:\WINDOWS\system32\CTsvcCDA.exe D:\WINDOWS\system32\nvsvc32.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\MsPMSPSv.exe D:\WINDOWS\system32\notepad.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Grisoft\AVG Free\avgwb.dat D:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe D:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/yco...search/ie.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O4 - HKLM\..\Run: [NVRaidService] D:\WINDOWS\System32\nvraidservice.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [NVIDIA nTune] "D:\Program Files\NVIDIA Corporation\nTune\\nTune.exe" clear O4 - HKLM\..\Run: [type32] "D:\Program Files\Microsoft IntelliType Pro\type32.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [svchost] SVCH0ST.exe O8 - Extra context menu item: &ieSpell Options - res://D:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM O8 - Extra context menu item: Check &Spelling - res://D:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - D:\Program Files\ieSpell\iespell.dll O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - D:\Program Files\ieSpell\iespell.dll O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - D:\Program Files\ieSpell\iespell.dll O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - D:\Program Files\ieSpell\iespell.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204 O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab O16 - DPF: {31E68DE2-5548-4B23-88F0-C51E6A0F695E} (Microsoft PID Sniffer) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_2.1.2.76.cab O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/soft...ch/alaunch.cab O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc4.webresponse.one.microso.../TLIEFlash.CAB O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.7) - http://gameadvisor.futuremark.com/global/msc37.cab O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab O20 - Winlogon Notify: WBSrv - D:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - D:\WINDOWS\system32\LEXBCES.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
__________________
EVGA 680i // Antec P180B Intel Core 2 Duo E6600 2GB Corsair XMS2 Dominator EVGA 8800GTX > MAG 22" (x2) Audigy 2 ZS > a) PA2V2 > Alessandro MS-1s (music); b) Pioneer VSX-516-K/S > Insignia NS-B2111 (2) 74GB WD Raptor | 500GB WD Caviar SE16 Antec TruePower 2.0 ..at factory timings. |
|
|
|
11-19-2006, 10:48 AM
|
#2 (permalink) |
|
Digaredd
 
Join Date: May 2005
Location: Melbourne AU
Posts: 6,423
|
The only thing showing in the log is this entry.
O4 - HKCU\..\Run: [svchost] SVCH0ST.exe Notice the zero instead of capital "O". SVCH0ST You'll need to search for that file and delete it. Also run a scan with AVG Anti-Spyware and post the results. http://downloads.grisoft.cz/softw/70...p-7.5.0.50.exe
__________________
The Grim Reaper - Son of Glyndwr "To Hell or Connacht" may you burn in Hell tonight! |
|
|
|
|
11-19-2006, 11:33 AM
|
#3 (permalink) |
|
Diamond Member
 
Join Date: Aug 2004
Location: Oahu
Age: 27
Posts: 6,273
|
if you have a good firewall it would of detect the activity beforfe it attempts to send your account to the other user.
__________________
QX9650@4.2 swiftech |9600@3.0 9700 nt 780i | 790fx 8gb ddr1200 | 8gb ddr1200 2x150gb 3x1tb |2x250gb 3x8800gtx |3x2900xt 1gb 2x20xdvdrw |2x20xdvdrw 15in1 card reader |15in1 card reader ng15/g9 |ng15/g9 1200w psu |1200w psu 2x28" LCD |2x28" LCD |
|
|
|
|
11-19-2006, 06:37 PM
|
#4 (permalink) |
|
Diamond Member
Join Date: Jun 2005
Location: Computer Engineering @ NCSU
Posts: 1,271
|
avg log attached
__________________
EVGA 680i // Antec P180B Intel Core 2 Duo E6600 2GB Corsair XMS2 Dominator EVGA 8800GTX > MAG 22" (x2) Audigy 2 ZS > a) PA2V2 > Alessandro MS-1s (music); b) Pioneer VSX-516-K/S > Insignia NS-B2111 (2) 74GB WD Raptor | 500GB WD Caviar SE16 Antec TruePower 2.0 ..at factory timings. |
|
|
|
|
11-19-2006, 06:50 PM
|
#5 (permalink) |
|
Diamond Member
Join Date: Apr 2006
Posts: 1,231
|
doesnt WoW have some sort of protection against theft or somekind of insurance if your character is hacked. shouldnt there be a log of whoever logs onto to an account at which IP
__________________
The Shit:
Antec P180B ASUS M2N-SLI Deluxe AM2 nForce 570 AMD X2 4200+ AM2 @ 2.42 CORSAIR XMS2 DDR2 800 2X1GB eVGA 256MB 7900GT KO BenQ 19" 2ms LCD Creative Sound Blaster Audigy2 ZS 3DMark03~19601 |
|
|
|
|
11-19-2006, 06:53 PM
|
#6 (permalink) | |
|
Diamond Member
Join Date: Jun 2005
Location: Computer Engineering @ NCSU
Posts: 1,271
|
Quote:
__________________
EVGA 680i // Antec P180B Intel Core 2 Duo E6600 2GB Corsair XMS2 Dominator EVGA 8800GTX > MAG 22" (x2) Audigy 2 ZS > a) PA2V2 > Alessandro MS-1s (music); b) Pioneer VSX-516-K/S > Insignia NS-B2111 (2) 74GB WD Raptor | 500GB WD Caviar SE16 Antec TruePower 2.0 ..at factory timings. |
|
|
|
|
 |
| Bookmarks |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Please help! (ASAP, need this immediately!) | Duffman656 | CD/DVD Technology | 3 | 11-11-2006 11:10 AM |
| KeyLoggers | Bramp | Computer Security | 3 | 07-05-2006 11:55 PM |
| Way to detect keyloggers? | CelticWolf | Computer Security | 1 | 04-25-2006 02:17 PM |
| VIP (Very Important Poll) | Apokarteron | Computer Security | 2 | 11-19-2005 04:26 PM |
| Computer turns on immediately after shut down? | cashmoney818 | General Computer Chat | 10 | 09-28-2005 01:19 PM |
Linear Mode
