Overclock.net › Forums › Software, Programming and Coding › Networking & Security › Help My friend is being keylogged
New Posts  All Forums:Forum Nav:

Help My friend is being keylogged

post #1 of 29
Thread Starter 
Well my friend is getting keylogged, his email has been hacked and his runescape has been hacked, I don't know about this but apparently some runescape accounts are worth over $400 well his account got stolen. He doesn't really care about his account but more worried about the keylogger accessing credit card and steam info ect.

Well he has scanned with all the spyware that I have recommended him, we looked at all the processes but we cant seem to find anything could you guys have a look at the processes and see if there is anything suspicious

Lots of pics inbound
post #2 of 29
Thread Starter 





post #3 of 29
Thread Starter 
Can you guys spot anything that could be a keylogger, if so please let me know
Thank you very much
rep+ to you
post #4 of 29
I suggest a quick format for the system.
post #5 of 29
Quote:
Originally Posted by Boyd View Post

I suggest a quick format for the system.

exactly, the only way to be sure, reformat and reinstall windows
Easy V3
(17 items)
 
12 Pack
(15 items)
 
 
CPUMotherboardGraphicsRAM
i7-4820k Asus Rampage IV BE evga 1080ti FE w/ hybrid kit 16 GB G.Skill Trident X 2400mhz  
Hard DriveHard DriveOptical DriveCooling
Samsung 840 EVO 120gb Samsung 840 EVO 1TB Samsung Blu-ray Corsair H110 
OSMonitorKeyboardPower
windows 10 Asus PG278Q Ducky Shine 3 - blue led - cherry mx browns Seasonic Platinum-1000 
CaseMouseMouse PadAudio
Dimastech Easy V3 Mionix NAOS 8200 Mionix Ensis 320 titanium HD  
Other
audio technica ATH-A900X 
  hide details  
Reply
Easy V3
(17 items)
 
12 Pack
(15 items)
 
 
CPUMotherboardGraphicsRAM
i7-4820k Asus Rampage IV BE evga 1080ti FE w/ hybrid kit 16 GB G.Skill Trident X 2400mhz  
Hard DriveHard DriveOptical DriveCooling
Samsung 840 EVO 120gb Samsung 840 EVO 1TB Samsung Blu-ray Corsair H110 
OSMonitorKeyboardPower
windows 10 Asus PG278Q Ducky Shine 3 - blue led - cherry mx browns Seasonic Platinum-1000 
CaseMouseMouse PadAudio
Dimastech Easy V3 Mionix NAOS 8200 Mionix Ensis 320 titanium HD  
Other
audio technica ATH-A900X 
  hide details  
Reply
post #6 of 29
Toolbar updater needs to go, might want to look into vprot.exe and monitor.exe, they may be part of avg but I'm not sure. Seachsettings.exe is also suspicious, he should really run MalwareBytes and ComboFix to see if anything is on there. If he still doesn't find anything, he should back up his data and format the drive with this method, it is the only way to be sure:
Warning: Spoiler! (Click to show)
1)Switch to Storage Setting to AHCI (refer to motherboard's manual)

2)Boot from the Windows 7 DVD

3)When you see the three options related to choosing a language, click Next

4)When you see the window with the big "Install Now" button, click the text below it that says "Repair Your Computer" to provide access to where we need to be

5)You'll see a little window appear named "System Recovery Options" which will immediately search for Windows installations

6)When it finishes, you will see a dialog box. Select "Use recovery tools that can help fix problems starting Windows. Select an operating system to repair." Now highlight the appropriate Windows installation and then click Next.

Start here if you are using your SSD as a Data Drive and Windows is already installed.
-Note: This can be done from a command prompt in windows or with Disk Management if you are using your SSD as a data drive.

7)Click "Command Prompt"

8)Type diskpart to load DiskPart

9)Type list disk

10)Type select disk 0 (or whichever number your SSD gets, the size should tell you which is drive is which)

11)If you want to be sure you have the right one selected, type list partition.

12)Once you know you have the right drive selected, type clean.

13)Type create partition primary align=1024

14)Type format quick fs=ntfs

15)Once its finished, Type active

16) Type list partition to verify the new parition.

17)Type exit

18)Type exit again

19)Click Restart

20)Boot from the DVD again and perform a normal installation using the "Custom (advanced)" type of installation. DO NOT FORMAT THE DRIVE AGAIN!!
post #7 of 29
Thread Starter 
Yeah But he really doesnt want to lose his saved games that are not backed up and if he backs them up it could transfer the keylog
post #8 of 29
I heard there is a duplicate winlogon file in task manager. End one of those tasks, is how I did it on my old machine. It's kind of like red wire or blue wire on a bomb; you don't know which one is real or the keylogger.
Delta IV Heavy
(17 items)
 
Atlas V 431
(22 items)
 
 
CPUCPUMotherboardGraphics
Xeon X5650 Xeon X5650 Supermicro C602  Quadro 2000 (780 Ti within next 4 years) 
RAMHard DriveHard DriveHard Drive
24GB 300 GB, 10,00 RPM WITH VTEC YO!!! Crucial MX100 256GB WD Black 1TB 
Hard DriveHard DriveCoolingOS
WD Black 1TB WD Black 1TB Stock HP heatpipe coolers Windows 7 Ultimate 64 Bit 
MonitorKeyboardPowerCase
AOC 21 Stock HP Delta 80+ PLATINUM 1000W HP Z820 
Mouse
HP 
  hide details  
Reply
Delta IV Heavy
(17 items)
 
Atlas V 431
(22 items)
 
 
CPUCPUMotherboardGraphics
Xeon X5650 Xeon X5650 Supermicro C602  Quadro 2000 (780 Ti within next 4 years) 
RAMHard DriveHard DriveHard Drive
24GB 300 GB, 10,00 RPM WITH VTEC YO!!! Crucial MX100 256GB WD Black 1TB 
Hard DriveHard DriveCoolingOS
WD Black 1TB WD Black 1TB Stock HP heatpipe coolers Windows 7 Ultimate 64 Bit 
MonitorKeyboardPowerCase
AOC 21 Stock HP Delta 80+ PLATINUM 1000W HP Z820 
Mouse
HP 
  hide details  
Reply
post #9 of 29
Copy any photos, or other really important files, and format the hard drive. If there is anything on it, a few formats with the Windows installation disk will blow it away.
Folder Rodriguez
(21 items)
 
   
CPUMotherboardGraphicsRAM
i7 3770k MAXIMUS V FORMULA EVGA 680 FTW+ 4GB  16GB (2x8GB) G.SKILL Trident X 2400mHz CL10 1.65V 
Hard DriveHard DriveOptical DriveCooling
Corsair Force 3 120GB SSD Seagate SV35.5 2TB 64MB cache 7200 RPM HDD LG blu-ray R/W Heatkiller CU 3.0 Nickel/Black 115X 
CoolingCoolingCoolingOS
Swiftech MCP355 w/ Petra's Mod Top Undecided radiator config 12mm OD push fittings, and E22 12mm acrylic tubing Slackware 64-bit 
OSMonitorKeyboardPower
Arch Linux 64-bit Asus 24" 1920x1080 LED Rosewill 9000 w/ MX Blues Seasonic X650 
CaseMouseMouse PadOther
Scratch build test bench Logitech G600 black Xtrac Ripper XXL 2x Corsair AF 140mm quiet edition case fans 
Other
Promilatech PK-1 
AudioAudioAudioOther
**Possibly used** HifiMan HE-500 headphones **USED** Schiit Lyr headphone amp Jolida Glass FX Tube DAC EK Nickel CSQ 680+ Waterblock 
OtherOtherOther
2x Aplhacool NexXxos UT60 360mm full copper rad... 6x Scythe Gentle Typhoon 1450 RPM fans 10 meters of 12mm OD nickel plated copper pipe,... 
CPUMotherboardAudioAudio
4770k Asus Maximus VI Impact Audeze LCD-2 Woo Audio WA3  
Audio
Jolida Tube FX DAC 
  hide details  
Reply
Folder Rodriguez
(21 items)
 
   
CPUMotherboardGraphicsRAM
i7 3770k MAXIMUS V FORMULA EVGA 680 FTW+ 4GB  16GB (2x8GB) G.SKILL Trident X 2400mHz CL10 1.65V 
Hard DriveHard DriveOptical DriveCooling
Corsair Force 3 120GB SSD Seagate SV35.5 2TB 64MB cache 7200 RPM HDD LG blu-ray R/W Heatkiller CU 3.0 Nickel/Black 115X 
CoolingCoolingCoolingOS
Swiftech MCP355 w/ Petra's Mod Top Undecided radiator config 12mm OD push fittings, and E22 12mm acrylic tubing Slackware 64-bit 
OSMonitorKeyboardPower
Arch Linux 64-bit Asus 24" 1920x1080 LED Rosewill 9000 w/ MX Blues Seasonic X650 
CaseMouseMouse PadOther
Scratch build test bench Logitech G600 black Xtrac Ripper XXL 2x Corsair AF 140mm quiet edition case fans 
Other
Promilatech PK-1 
AudioAudioAudioOther
**Possibly used** HifiMan HE-500 headphones **USED** Schiit Lyr headphone amp Jolida Glass FX Tube DAC EK Nickel CSQ 680+ Waterblock 
OtherOtherOther
2x Aplhacool NexXxos UT60 360mm full copper rad... 6x Scythe Gentle Typhoon 1450 RPM fans 10 meters of 12mm OD nickel plated copper pipe,... 
CPUMotherboardAudioAudio
4770k Asus Maximus VI Impact Audeze LCD-2 Woo Audio WA3  
Audio
Jolida Tube FX DAC 
  hide details  
Reply
post #10 of 29
I agree with formatting. If he wants to be certain it's gone, format the system.

Has he run Malwarebytes to scan?
Number Cruncher
(16 items)
 
HTPC
(11 items)
 
750TIMINER2
(15 items)
 
CPUMotherboardGraphicsRAM
i7 2600k ASUS Sabertooth Z77 Sapphire 290 Tri-x 4GB OC CORSAIR Vengeance 16GB 
Hard DriveHard DriveHard DriveOptical Drive
Intel 520 120 GB SSD Seagate Barracuda 1 TB 250GB Samsung 840 EVO SSD LG Blu-Ray Lightscribe Combo Burner 
CoolingOSMonitorPower
Swiftech H320 (CPU only) Windows 7 Ultimate 27" Shimian 1440p Monitor 1000W Corsair PSU 
CaseMouseMouse PadAudio
800D custom painted and fixed up! 15 year old Microsoft Custom Minecraft Mousepad Logitech 2.1 Speakers (wub wubbity wub wub) 
CPUMotherboardGraphicsRAM
i5 3570k MSI Z68 MA-ED55 MSI GTX 750 Ti 6GB Corsair XMP 
Hard DriveOptical DriveCoolingOS
500GB WD Blue ASUS DVD Burner Hyper 212+ Windows 8.1 
PowerCase
Rosewill HIVE 750W Rosewill Blackbone 
CPUMotherboardGraphicsRAM
AMD Sempron 145 Gigabyte 990FXA-UD3 4x MSI GTX 750 Ti 6 GB Corsair XMP 
Hard DriveCoolingOSMonitor
500 GB Seagate Barracuda Stock Windows 7 LG 20" 900p display 
KeyboardPowerCaseMouse
Dell generic Rosewill HIVE 750W Rosewill Thor V2 Dell generic 
Other
4x USB Powered Risers 
  hide details  
Reply
Number Cruncher
(16 items)
 
HTPC
(11 items)
 
750TIMINER2
(15 items)
 
CPUMotherboardGraphicsRAM
i7 2600k ASUS Sabertooth Z77 Sapphire 290 Tri-x 4GB OC CORSAIR Vengeance 16GB 
Hard DriveHard DriveHard DriveOptical Drive
Intel 520 120 GB SSD Seagate Barracuda 1 TB 250GB Samsung 840 EVO SSD LG Blu-Ray Lightscribe Combo Burner 
CoolingOSMonitorPower
Swiftech H320 (CPU only) Windows 7 Ultimate 27" Shimian 1440p Monitor 1000W Corsair PSU 
CaseMouseMouse PadAudio
800D custom painted and fixed up! 15 year old Microsoft Custom Minecraft Mousepad Logitech 2.1 Speakers (wub wubbity wub wub) 
CPUMotherboardGraphicsRAM
i5 3570k MSI Z68 MA-ED55 MSI GTX 750 Ti 6GB Corsair XMP 
Hard DriveOptical DriveCoolingOS
500GB WD Blue ASUS DVD Burner Hyper 212+ Windows 8.1 
PowerCase
Rosewill HIVE 750W Rosewill Blackbone 
CPUMotherboardGraphicsRAM
AMD Sempron 145 Gigabyte 990FXA-UD3 4x MSI GTX 750 Ti 6 GB Corsair XMP 
Hard DriveCoolingOSMonitor
500 GB Seagate Barracuda Stock Windows 7 LG 20" 900p display 
KeyboardPowerCaseMouse
Dell generic Rosewill HIVE 750W Rosewill Thor V2 Dell generic 
Other
4x USB Powered Risers 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Networking & Security
Overclock.net › Forums › Software, Programming and Coding › Networking & Security › Help My friend is being keylogged