keylogger

[broksen]

Hey,

just have 1 question : could it be a keylogger?

C:\Documents and Settings\x\AppData\winlogon.exe


This entry is not running from the System32 folder, so it is probably nasty.
Possibly nasty! According to our database this process runs normally in c:\windows\system32\! Check if you know this process and arrange a viruscheck where required. This process is not running from the System32 folder as it is supposed to be.

Scaned with hijackthis.

Asking cause someone tryed to log into my acc few hours ago, anyway he was too slow cause sent full g60/g65 bofed to my friend but anyway wanna do something with it.

[RunzelEier]

yes that is malware

you should scan it with virustotal or check if the program connects to any server.

[broksen]

how to check that?



are these virus's dangerous?

[vairisleiboms]

int or pserver?

[broksen]

what do u mean? ofc am playing int

[Fremo.]

virus

[broksen]

- Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll

could it be keyloger?

scanned with virustotal and nothing found

[Ksystem13]

Originally Posted by broksen

- Unknown file in Winsock LSP: c:\windows\system32\prxernsp.dll

could it be keyloger?

scanned with virustotal and nothing found

Use this

[broksen]

that spybot deleted my antivir cause he detected it as "keyloger protector" piece of ****, helpless

[Ksystem13]

Originally Posted by broksen

that spybot deleted my antivir cause he detected it as "keyloger protector" piece of ****, helpless

Then don't beg for help anymore oke?

[broksen]

Ty Fr..ome for tutorial how to delete svchost with the Description with "VirtualDub blabla"

@up

I love u too

but cant understand 1 thing: deleted svchost from HKCU\Software\Microsoft\Windows\CurrentVersion\Run

but hijack this still say :
O4 - HKCU\..\Run: [svchost] C:\Documents and Settings\x\AppData\svchost.exe

Must be fixed! Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a

Edit: problem solved

ps. my pc never was cleaner