18 replies to this topic

[xx_WLT_xx]

How to detect if you are infected:

First of all, if you first ran the keylogger, it shows you this:

http://I'mg.photobucket.com/albums/v29...xx/firstrun.gif
Fig 1.1 Keylogger when run

Look at that firewall message. It shows that it access the internet. and it also shows you that nifty fakebox. but even if you ignore it, it has already infected your system.

The next step, I look over at msconfig to see what program it made to run at start-up:

http://I'mg.photobucket.com/albums/v29...xx/msconfig.gif
Fig 1.2 MsConfig Dialog Box

Look at that explorer.exe. Hmm, it looks suspicious!! Explorer.exe is the Windows shell AND IT IS LOCATED IN C:\%WINDIR%\Explorer.exe!!! lol, it MUST BE THE KEYLOGGER!! Here is another piccy showing explorer.exe accessing the internet:

http://I'mg.photobucket.com/albums/v29...xx/firewall.gif
Fig 1.3 Firewall Protection

And it sure does access the internet every now and then.
I tried to see it. It is hidden tho, look:

http://I'mg.photobucket.com/albums/v29...denexplorer.gif
Fig 1.5 Hidden explorer.exe

To test if it DOES write to a file, like most KeyLoggers do, I performed the forward date search method:

http://I'mg.photobucket.com/albums/v29...rwardsearch.gif
Fig 1.6 Forward One-Year Search

lol, so, THIS IS THE LOGFILE!!
I tried the regedit.......:

http://I'mg.photobucket.com/albums/v29..._xx/regedit.gif
Fig 1.7 RegEdit

Oh lol, it sure does run the file from the registry. So, we got now how it works. now how do we get rid of it? You might think that we CAN delete it but remember, WE CANNOT DELETE any program in use or a program that is loaded in memory. So how do we get rid of it? First routine, we MUST disable the program from running in startup. To do this, we open up regedit and goto Local Machine\Software\Microsoft\Windows\CurrentVersion\RunServices and delete the registry key:

http://I'mg.photobucket.com/albums/v29...istrydelete.gif
Fig 1.8 Delete the key

Next, we restart our comp. After that, we delete the log-file and the program itself. NOTE: If you don't restart your computer, you'd get this error:

Access Denied cause the program is running in memory so we have to restart the computer first:

http://I'mg.photobucket.com/albums/v29...ccessdenied.gif
Fig 1.9 Access Denied



That's all folks. I hope I helped you

-xx_WLT_xx

[Cooliodoc]

thanks for posting this WLT I was looking for how to get rid of the kelogger but I couldn't remember the name

Edited by cooliodoc, 24 August 2004 - 05:31 AM.

[Dan]

I dont have anything in my runservices folder???

[Cooliodoc]

Oh it appears that VET deleted it when I first ran the prog to see what trojan/kl it was. Yay, is it possible that the program has taken some hybrid form anyone with windows xp found the keylogger hiding somewhere?

[xx_WLT_xx]

it's not folder, LBA. It's in the registry. Anyway, if you can't run it, just look at Fig 1.2 above and UNCHECK THE BOX BESIDE explorer.exe   and restart your comp and delete it

[Dan]

Thats the point. In my startup, I had no Explorer.exe. I went to the registry to find it in the runservices, and nothing is in that part of the registry.

Euphoria is helping me

Can you do one for the aber now? I cant see this entry in my registry!

Edited by LemonyBrainAid, 24 August 2004 - 07:16 AM.

[Funnlecake]

I just found a keylogger this morrning

[Fatal]

ROTFLMAO nifty?? thats soo funny hhehehehehee lol  ya good expaination WLT master

[Free of Misery]

ad-aware deletes them for me

along with my skill of stopping processes..

Edited by rodents, 25 August 2004 - 05:50 AM.

[ShadowLink64]

Wow, good job WLT

Very neat explanation, and good pics

[XenoCyde]

I have experience with this Keylogger B)

they are easy to make lol
The error is a fake you can setit up in the keylogger program also the keylogger can set ti'mes to send logs, e.g 10mins, 10hrs, 10days, The logs are send to the keyloggercreators email in attachment form B)

SCKeylog is the company

[ZERO]

I have experience with this Keylogger B)

they are easy to make lol
The error is a fake you can setit up in the keylogger program also the keylogger can set ti'mes to send logs, e.g 10mins, 10hrs, 10days, The logs are send to the keyloggercreators email in attachment form B)

SCKeylog is the company

Wow, nice guide man, was this a program that was recently in codex that I misseD?

[pokhermama]

zero I think this was a prog posted on '3' not sure though

[Greeny]

thanks for the guide

[Tormentedsoul14]

The images dont work anymore

[Cript]

The images dont work anymore

Hopefuly he'll fix them..if he's around...Having a sticky should mean we keep these things updated.

[Mr. Hobo]

Keep in mind it's from 04 o.0

[Gargar]

Un-stickafied. If he comes back he can make a new updated one.