Problem With A Keylogger In My Pc!

Hi everyone and thanks for the replies in my first post, they helped me.

I have a Keylogger that sends mails to an unknown destiny each 15 min.

I can stop the keylogger to continue running -or sending mails- [typing CTRL+ALT+SUPR, and finishing a process called "PFCX.EXE"] which is not a good solution, because I have to do this each time I change the user or Restart my computer, also my family don't know how to do this and teach them will be a waste of time.....

Also I disabled the same file in the start up from msconfig.exe (it showed its location: C:\Windows\system32) but the file continue openning in the start up :confused: .....

Then I searched for the file but it doesn't exists..... also I tried whith norton but I found nothing

Please I need help on this.

Thanks Pablo

SORRY, :rolleyes: I forgot to say, I have Windows XP

trojan horses and keyloggers sometimes use the same methods for auto startup i suggest
reading the file i have attached to this message it covers some of the methods used for auto starting trojans...

try grabbing the cleaner

http://www.moosoft.com/thecleaner/

hey Pablo I've got a question for you. How'd you know that it was a keylogger?

Quote:

---

Originally posted here by black_death
trojan horses and keyloggers sometimes use the same methods for auto startup i suggest
reading the file i have attached to this message it covers some of the methods used for auto starting trojans...

---

Use the above and if the problem presists shearch the registry for PFCX.EXE and delete the entries. You should also check the startup folder.

On the HD the folder the offending file is in might give you more info w/r/t where it came from. When I search google I only get 2 hits for PFCX.EXE. Both are tied to the same geocities page for VGA Planets.

Cheers,
-D

Heya,

I've been playing with that Hellhackz-thing myself for a while after you posted that link. As stated by Mahakaal, it's the Soft-Central Keylogger.

Once you execute the hellhackz.exe file, it tries to contact mx1.hotmail.com to mx4.hotmail.com.
Deleting PFCX.EXE indeed is the solution. Just deleting it in Windows won't work. Deleting it in DOS won't work either (even if you remove the +r and +h attributes), so I found something else.

Just do a search for pfcx.exe (Start --> search). In Windows 2k, it is in C:\winnt\system32.
Once you found the file, ctrl-alt-del to taskmanager and kill the pfcx.exe process.
Then right-click it in the search-window, and select delete. Weird, but it works...

And of course make sure to get rid of the original hellhackz.exe ;)

Hope this helped.

Quote:

---

Then I searched for the file but it doesn't exists

---

Make sure that you are configured to show hidden files and folders. If the program is loading but you are unable to find it you may be set up to not show any hidden files.

would "msconfig" help. when i run that i can control what starts up on my box [xp].
i know this won't slove prob but could make runnin ur pc better untill u get rid of this.
i type... run > msconfig

just a thought.

I've seen some of these programs also start themselves as services, so there is another place to look if you don't find anything in the usual startup places.

well while trying to find a sollution to your problem,i would suggest you to install a firewall.then you can control the whole network trafic and prevent the program to connect to its server.then try to solve the problem.

Quote:

---

Originally posted here by amon
well while trying to find a sollution to your problem,i would suggest you to install a firewall.then you can control the whole network trafic and prevent the program to connect to its server.then try to solve the problem.

---

An even better way to do this would to be to use a traffic sniffer with your firewall.

If you are on either m$ or *nix, I would recommend ethereal.

Even though your firewall will block it from getting out of your network, you can look at the traffic more closely. That might shead some light on your problem.