Please I Need Help!

Printable View

December 12th, 2002, 09:54 PM
pmandiola

Please I Need Help!

Hi,

I used to play Helbreath Crusade, an online RPG game, and one of the players announced that in his web site he had hacks for the game. I went to the site (www.helhackz.cjb.net) and I downloaded the file, when I executed the file, nothing happened.

Now each 15 min. (aprox) the PC automatically sends a mail to an unknown destiny. :confused:

In the same game another player said that this hacks weren't for the game, instead it sends a mail with all the thing you typed in the keyboard.

:( Please I need help to solve this problem....

Thanks
December 12th, 2002, 10:00 PM
DjM

Sounds like you downloaded a keylogger to your system. Are you running any anti-virus or trojan scanning programs?
If not, you can run an online scan HERE
I am not sure if it will detect keyloggers but you might want to give it a try.

Good Luck
December 12th, 2002, 10:03 PM
gore

ok, youv pretty much downloaded a keylogger, when nothing happened, what actually happened was a keylogger (maybe even a trojan) was installed, so prettymuch everything your typing is being sent to him so he can get your passwords and stuff your typing (for example your post) for one, delete the file, and also, do a search on your computer with the find files thingy in the start menu and type in the file name and search, im not sure what else to look for but im sure another member can hlp you with what to do next.
December 12th, 2002, 10:40 PM
Virtus

Not to be mean or anything, but that is what happens when you cheat..
Dont cheat with online games... like CS i used to play that 12/5 but never play it anymore cause there are sooooo many cheats, aimbots, wallhacks ect. ect.

So dont cheat =)
December 12th, 2002, 10:50 PM
Mahakaal

It's the Soft-Central keylogger, and anti-virus won't pick it up. This is what my packet sniffer picked up...

Quote:

From: <[email protected]>
To: [email protected]
Reply-To: <[email protected]>
Subject: Installation of SC-KeyLog on host ****-8RDKY5XD5L

(***********) succeeded
X-Mailer: SC-KL Mail service
MIME-Version: 1.0
Date: Thu, 12 Dec 02 15:08:40 Central Standard Time
Content-Type: multipart/mixed;
boundary="----_=_NextPart_000_01C19920.83032BC0"

This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.

------_=_NextPart_000_01C19920.83032BC0
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C19920.83032BC0"

------_=_NextPart_001_01C19920.83032BC0
Content-Type: text/plain;
charset="iso-8859-1"

You will receive an activity report every 0 days, 0 hours and 20

minutes from this host. Thank you for using SC-KeyLog!</p>

------_=_NextPart_001_01C19920.83032BC0
Content-Type: text/html;
charset="iso-8859-1"

<HTML><HEAD><TITLE>Installation of SC-KeyLog on host ****-8RDKY5XD5L

(**********) succeeded</TITLE></HEAD><BODY>

<table align='center' border='0' width='100%' cellpadding='8'

cellspacing='0'>
<tr><td align='center' bgcolor='#000099' valign='middle'><H1><font

color='#CCCCCC'>
Installation of SC-KeyLog on host ****-8RDKY5XD5L (*********)

succeeded</font></H1></td></tr></table>

</p>

You will receive an activity report every 0 days, 0 hours and 20

minutes from this host. Thank you for using

Do a search of your hard drive for "helhackz", and delete all files that come up.

And dont cheat on online games :mad:
December 12th, 2002, 11:02 PM
da'dodo

If you hit CTRL+ALT+DEL then you can see what's running and you may be able to end task it. This will only work as a temporary fix.
For a more permanent way, you have to prevent it running from when the computer boots. There are a few ways it could start. The easiest is just running it from start, programs, startup, but very few use this. If this is the case, just delete it from the folder.
Alternatively it could start from the startup files, or the registry. If you know what the keylogger's called, you could run regedit, and do a search for it. WARNING; if you do this, make sure to back up the registry first!!! If you find a corresponding key, just delete it and reboot.
Alternatively, it could run through autoexec.bat. Goto start, run and then type msconfig. Go through all the tabs, and disable anything that shouldn't be there.
How do you know it's sending mails, by the way? And ask you're mate what it's called. Then do a search for it on the net, and try and find any other advice. Each keylogger runs in a slightly different way, and so it's worth working out how to specifically remove this one, and not generically.
December 12th, 2002, 11:07 PM
Virtus

Quote:

If you hit CTRL+ALT+DEL then you can see what's running and you may be able to end task it.

Thats only NT System that allows that.. 95,98 and ME dont..
But a good tip thoug =)
December 12th, 2002, 11:15 PM
magnoon

Quote:

If you hit CTRL+ALT+DEL then you can see what's running and you may be able to end task it.

Quote:

Thats only NT System that allows that.. 95,98 and ME dont..

Virtus.. ctrl-alt-del will bring up the close program dialog box on Win 9x. Almost all applications that are running will be displayed in this list and can be closed.
December 12th, 2002, 11:20 PM
Virtus

Most likely the program is a system process and will not be displayed...
December 12th, 2002, 11:21 PM
Spyder32

Yeah, never cheat on online game's, it always come's back to haunt you one way or another. Btw, do you know where I can get this game, I love Online RPG's and I'd love to try it out. Could you possibly link me to the site?
December 12th, 2002, 11:28 PM
da'dodo

First, thanks, Virtus. But I beg to differ on 98 not being able to. I know OS's built on an NT kernel do it better (they get it right more times, and a lot faster) but 98 does as well and all the other 9x OS's. What you are thinking of are processes, which 98, NT and ME don't show.
April 15th, 2003, 12:59 AM
tamariki

Have you tried Spybot from http://patrick.kolla.de/

You can check some running processes in win 9x by using the msconfig utility. A free process viewer is available from http://www.xmlsp.com/downloads-free.htm