*update* IMPORTANT: how to check to see if your PC has been keylogged.

Dayner

Dayner

camel man
Adventurer
Joined
Mar 15, 2005
Messages
1,601
Location
saudi arabia
Main Job
DarkKnight-Male
Server
Quetzalcoatl
FFXIV
Dayner Camelman
*update* IMPORTANT: how to check to see if your PC has been keylogged.

thanks to the ppl at BG
they found out if you got the keylogger or not

yes i know its in the other thread but its kinda deep

Definitely a gaming Keylogger, did a google on it.

http://www.google.com/search?q=k...t=firefox-a


Not good signs.

Hacked people I want you guys to also specifically check for THIS .exe file please: rsbo.exe

Also, check this WoW forums page:

http://forums.worldofwarcraft.com/thread.htm...9&sid=1

For people afraid to click:



A couple of days ago my account was hacked by a keylogger. Normally I'm a very secure person but I found out the issue and where it occurred. I have a few computer systems and one of my systems was using Trend Micro and it failed to notice the keylogger trojan injection. Here is the following information folks should be concerned about regarding this:

Trojan Type:

Agent.GDA type

Files:

C:\Windows\System32\rsbo.exe
C:\Windows\System32\kb1ss1p.dll
C:\Windows\System32\kb1ss1p.sys

Registry Key:
{ED0ACB58-556F-21DA-DDFE-6D20F3F611BB}

Start > Run > Regedit > go to top of list and click mycomputer > Edit > find > in3.dll/kb1ss1p.dll/rsbo.exe > find

The file rsbo.exe automatically creates the .sys and .dll files each time you login. They are stored in the windows\system32 directory. They inject themselves into the windows processes and remain hidden from "most" antivirus protection. Norton, McAfee, and Trend Micro did not find this trojan. The only software that found it was AVG Pro.

The method of injection occurred through Internet Explorer, even though I had all windows updates on that particular machine.

Again, this was not my main system but a secondary system that was affected. My main character Drabin (level 70 mage) was stripped of all gold, many items, and the incident reported. I'm waiting for (hopefully) reimbursement to come.

I am posting this as a helpful post so that others do not have this occur to them. Originally I had thought I retrieved the keylogger from WAU (Wow Ace Updater) but was sorely mistaken. Even though it is a third party software, the method of injection was not from this app.

Recommendations for other players so they don't get a keylogger:

# Don't use Internet Explorer (use Mozilla Firefox as it is a much safer and secure browser)
Use a solid Anti-virus package (do not use multiple)
Implement a Firewall
Use Hijackthis to check issues on your system
Use Spywareblaster to block and protect your browsers from known spyware/malware
Use Rootkit Unhooker (to find rootkit injections in your processes)
Use RegistryBooster or similar (to clean your registry of unwanted or susceptible rootkit hacks)
Click to expand...
also search for win32 and registry for d3dxo.dll

i got win32 but avast! found it and block it early today after i start my system

also if you got save password on your POL and it ask you to retype it ..

DO NOT DO IT

*edit*

Anti-Virus

avast! *avast! 4 Home Edition is free*
http://www.avast.com/eng/programs.html

AVG Anti-Virus *free*
http://www.download.com/3000-2239_4-10761481.html

Online scanner

Bit defender
http://www.bitdefender.com/scan8/ie.html

*update*

DO NOT USE *SOMEPAGE*

The iframe loads a page containing a harmful JavaScript exploit that attempts to install a Trojan on the victim's computer.

see link for more info
http://www.bluegartrls.com/forum/viewtopic.php?f=2&t=27256
 
Last edited:
Start > Run > Regedit > My Computer > Edit > Find

Search for: in3.dll/kb1ss1p.dll/rsbo.exe

And yes, DO NOT MANUALLY TYPE YOUR PASSWORD IF POL ASKS YOU TO.




Also, if you search for those files via Windows file search and then use the registry search, the names of those files will show up in HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603

Those are not actual malware, it's the history of windows search to query those file names.


I'm just posting that because I searched my computer using Windows and then used the registry, nearly freaked out when I assumed I had been infected...But luckily I'm clean.

Also pick up AVG Anti-Virus. It's free and seems to pick up most of these gaming trojans.
 
i'm using AVG free but following the advice of a friend i scaned with Bit defender online progam and it found a trojan that avg didn't find.
 
By all means, post a link where to download Bit defender^^
 
That means i'm safe I think. I was about to go on my ps2,change my pw, and not touch my pc version again until this was all sorted out.
 
Ok now i am a bit scared ...

Well those that know me know i just got a new comp a while ago and installed this on it

When i sign into pol it asks for my PW in a little box thats says insert member password before i can log on , Is that normal

yes i have 2 accounts on the list is that why?

no i never downloaded any 3rd pt softwhere and i know my friends pol does that too please tell me that is normal?
 
its better if you Search for the files

Start > Run > Regedit > My Computer > Edit > Find

Search for: in3.dll , kb1ss1p.dll and rsbo.exe
 
MissKittyKat said:
Ok now i am a bit scared ...

Well those that know me know i just got a new comp a while ago and installed this on it

When i sign into pol it asks for my PW in a little box thats says insert member password before i can log on , Is that normal

yes i have 2 accounts on the list is that why?

no i never downloaded any 3rd pt softwhere and i know my friends pol does that too please tell me that is normal?
Click to expand...

Are you sure the "insert member password" isn't the additional password for POL accounts? If it is the main POL password, don't fill touch it and follow the information posted here.
 
Crap i dont know if this is good or not...

Seached the rsbo.exe and got 4 found files
Default
001
002
Type REG_SZ

One says win32
rsbo.exe
directx


What do i do now???
 
Woo~ I'm clean.

Heh, thank god for AVG <_< I never use anything but AVG.
 
MissKittyKat said:
Crap i dont know if this is good or not...

Seached the rsbo.exe and got 4 found files
Default
001
002
Type REG_SZ

One says win32
rsbo.exe
directx


What do i do now???
Click to expand...

Don't type your password.

The virus scanners listed in this page will remove it.
 
How the hell did this happen to me of all people! , Damn it i always am so carefull

i dont use any 3rd party progs EVER no matter what game i dont download anything and i sure as hell dont go to odd sites


thank you all so much for bringing this to my attention , hope i can find it ...trying bit thing now i'll download avg after

I have nortan too ..Pos i guess hu?

For a pay one do you recomend avg?
 
AVG is free :)

This virus doesn't target 3rd party programs or weird webpages. It comes from FFXIAH advertisements, which is very popular.
 
I"m clean as well. I used Vista's file search and the regedit find and I didn't get anything back. I also use Trend Micro and the only thing it caught was a spy bot from something I downloaded from bittorrent and it quarantined it and I went to the infected file and deleted it. It called it a spy ware bot not a trojan virus.

Now occasionally when POL closes incorrectly, sometimes when I close my laptop out of habit, when I bring POL back up it will ask me to refill my password. It did that 2 days ago and I was a little surprised. Then I viewed this thread and looked for the files and found nothing. But just as a safety measure I changed my password again.
 
If you're totally paranoid like me... :foilhead:

...only change your password on a PS2 or XBOX.
 
well if you change your password on your PS2 or XBOX wouldnt you still have to key it in on the PC?

Or are you trying to avoid the hacking with the SSL portion of POL that will let you update your password?
 
Davion said:
well if you change your password on your PS2 or XBOX wouldnt you still have to key it in on the PC?

Or are you trying to avoid the hacking with the SSL portion of POL that will let you update your password?
Click to expand...


well, changing the pw first would just be a safety measure to make sure nothing happens while you clean the thing off of your pc.
 
Davion said:
well if you change your password on your PS2 or XBOX wouldnt you still have to key it in on the PC?

Or are you trying to avoid the hacking with the SSL portion of POL that will let you update your password?
Click to expand...

Good point, it would have to be typed regardless.
 
You must log in or register to reply here.
Back
Top