i can't find the keylogger or hacker

blackfrost13 · November 14, 2008

ok i'm going to start from the begging. this may be long so be prepared. ok...i play this game called world of warcraft. i love this game to death and it relaxes me from a day at work. anways...about a week ago or so there was post on the world of warcraft forum talking about some guys girlfriend naked some where. of course my instances gets the better of me and i go to the site. it said i need a newer verison of adobe flash player to view it which downloaded but still said i needed a newer verson. after ward i said screw it and left the website. next thing i know i try to play my game and some of my characters on my game was messed up. i ask a few of my friends and they said i might have got hacked. so what i do is download almost every ani virus and spyware bot on the net to try and clean my pc. when i do i also clean up all my cookies on the net and everywhere. the thing that struck me weird was when i cleaned up the browser history that one site that i went to before was still there and it wouln't go away. i was using firefox at the time. in order to get my character back in order i had to email blizzard and i emailed them from yahoo on IE. for someone reason everytime i tried to send a message IE crashed on me but when i used fire fox it went right thou. to this day IE still crashes on me when i try to send a message. after cleaning out my computer over and over again the hacker still got my account info after i changed the password over a thousand times. he has messed my characters up so bad but blizzard helped so much in restoring them to what they use to be. they acually got them perfect about 2 days ago and then boom again the hacker struck again. he didn't hurt them to bad but bad enough. i sent another email to blizzard thru firefox of course infomring them of what happened. i'm still running the anti virus and spyware but for some reason they can't find the problem. i ran malwarebytes 3 times and didn't find anything and running panda right now as i type. i just want this done and over with casue i'm so tired of sending emails and running scans. i don't know what else i can do. i even thought about restoring my computer but friends say that that hacker can still be there even after that. i ran macafee, ad-aware. malawarebytes, trend. and avg. i don't know what else i can do at this point to find it beside buy another computer. any help would be greatly appracted. i also download true sword and it said it found a spyware (MSuser/hper.bhq) but to get ride of it i have to buy the product. how come the other free ones didn't find this and even my mcafee i'm paying for didn't find this? if i have to restore my computer then i will but i just want to play my game and get this thing out of my computer.

alwarebytes' Anti-Malware 1.30

Database version: 1396

Windows 6.0.6001 Service Pack 1

11/13/2008 8:55:41 PM

mbam-log-2008-11-13 (20-55-41).txt

Scan type: Full Scan (A:\|C:\|D:\|E:\|)

Objects scanned: 108886

Time elapsed: 1 hour(s), 18 minute(s), 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

this is from panda:

Threats disinfected with the paid version (16)

Medium danger level (2) Spyware/Iehelp Spyware Latent Hide + Info

1. C:\iWin Games\iWinGamesHookIE.dll

Spyware/Iehelp Spyware Latent Hide + Info

1. C:\iWin Games\firefox\iWinArcadeLauncher.exe

Low danger level (14) Cookie/Apmebf Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...ookies\Low\blackfrost@apmebf[1].txt

Cookie/Atwola Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...ookies\Low\blackfrost@atwola[2].txt

Cookie/Traffic... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...ies\Low\blackfrost@trafficmp[1].txt

Cookie/Serving... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...ow\blackfrost@bs.serving-sys[1].txt

Cookie/Mediapl... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...ies\Low\blackfrost@mediaplex[2].txt

Cookie/YieldMa... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...w\blackfrost@ad.yieldmanager[2].txt

Cookie/Questio... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...ow\blackfrost@questionmarket[1].txt

Cookie/Tribalf... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...\Low\blackfrost@tribalfusion[2].txt

Cookie/Adverti... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...s\Low\blackfrost@advertising[1].txt

Cookie/Adrevol... Tracking Cookie Latent Hide + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...es\Low\blackfrost@adrevolver[1].txt

Cookie/Com.com Tracking Cookie Latent Show + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...s\Cookies\Low\blackfrost@com[1].txt

Cookie/Atlas D... Tracking Cookie Latent Show + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...Cookies\Low\blackfrost@atdmt[2].txt

Cookie/PointRo... Tracking Cookie Latent Show + Info

1. C:\Users\blackfrost\AppData\Roaming\Microsoft...Low\blackfrost@ads.pointroll[2].txt

Cookie/Doublec... Tracking Cookie Latent Show + Info

JeanInMontana · November 14, 2008

Hi and welcome to Malwarebytes. Please update MBAM run a quick scan post the log.

Please get HiJack This! install it to C:\Program Files

Close all programs leaving only HijackThis running, and click on scan and save a log. Post that log as a reply here in the body of the post, not as an attachment I will analyze it and give you instructions on the next step.

blackfrost13 · November 15, 2008

Hi and welcome to Malwarebytes. Please update MBAM run a quick scan post the log.
Please get HiJack This! install it to C:\Program Files
Close all programs leaving only HijackThis running, and click on scan and save a log. Post that log as a reply here in the body of the post, not as an attachment I will analyze it and give you instructions on the next step.

ok i ran both scans and here are the logs:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:15:52 PM, on 11/14/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe

C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\NETGEAR\WG111v2\WG111v2.exe

C:\Windows\System32\rundll32.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Intel\IntelDH\CCU\CCU_Engine.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\wuauclt.exe

C:\Program Files\Internet Explorer\ieuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\Macromed\Flash\FlashUtil9b.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Users\blackfrost\Downloads\mbam-setup.exe

C:\Users\BLACKF~1\AppData\Local\Temp\is-K9LO7.tmp\mbam-setup.tmp

C:\Users\blackfrost\Downloads\mbam-setup.exe

C:\Users\BLACKF~1\AppData\Local\Temp\is-HOMVV.tmp\mbam-setup.tmp

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [sigmatelSysTrayApp] C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe

O4 - HKLM\..\Run: [NMSSupport] "C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe" /startup

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 14\pccguide.exe"

O4 - HKLM\..\Run: [dscactivate] c:\dell\dsca.exe 3

O4 - HKLM\..\Run: [ECenter] c:\dell\E-Center\EULALauncher.exe

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe

O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL

O23 - Service: Intel® Alert Service (AlertService) - Intel® Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe

O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Intel® Software Services Manager (ISSM) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe

O23 - Service: Intel® Viiv Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe

O23 - Service: Intel® Application Tracker (MCLServiceATL) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Intel® Remoting Service (Remote UI Service) - Intel® Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

O23 - Service: SCM_Service - Unknown owner - C:\Windows\System32\WinService.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\STacSV.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 8344 bytes

Malwarebytes' Anti-Malware 1.30

Database version: 1399

Windows 6.0.6000

11/14/2008 8:27:37 PM

mbam-log-2008-11-14 (20-27-37).txt

Scan type: Quick Scan

Objects scanned: 47712

Time elapsed: 3 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

JeanInMontana · November 15, 2008

Please get CCleaner Install the program run the scan. If you have any queries or comments then please use the Forum or contact us via this form..

Do not use the registry cleaner feature uncheck that option. Clean temp files, cookies, and unnecessary items. Reboot.

Update MBAM post a new log and a new HJT log. In this order

blackfrost13 · November 15, 2008

Please get CCleaner Install the program run the scan. If you have any queries or comments then please use the Forum or contact us via this form..
Do not use the registry cleaner feature uncheck that option. Clean temp files, cookies, and unnecessary items. Reboot.
Update MBAM post a new log and a new HJT log. In this order

Malwarebytes' Anti-Malware 1.30

Database version: 1400

Windows 6.0.6000

11/15/2008 11:47:46 AM

mbam-log-2008-11-15 (11-47-46).txt

Scan type: Quick Scan

Objects scanned: 48116

Time elapsed: 4 minute(s), 31 second(s)