I've been hexing a vb6 program for the past hour and can't find what I need found. I'm using Hex Workshop Hex Editor and I'm trying to find a pws/keylogger entry in a 10mb. executable with no search strings in mind..... because I don't keylog. {-_-} Anyhow, I was wondering if anyone knew of some search strings to try so I can track down this guy and maybe disable him so I can use the program without having to worry about it pws'ing. I tried quite a few query's but had no luck. I am 100% positive that it's there and I'm 100% sure that it uses an ICQ UIN as the interceptor of the passwords to be forwarded to. I did some google searches, found some src sort of like this and tried to plug some strings in there but still had no luck. Any suggestions on some hex or ascii strings to search for ? I've actually seen this pws/keylogging function extracted before and pasted in a chatroom to expose the author of the program after it'd been found through a hex, so I know it without a doubt is there. So far I've tried "uin", "rcpt" and many others all leading no where. I tried all of these in lowercase and uppercase strings -- hex and ascii. If anyone knows some stuff to try, I'd be more than glad to try them. Thanks.

Adam