*update* IMPORTANT: how to check to see if your PC has been keylogged.

Or you can have all your PWs saved and just make a PoL log in password. It's safe and you never have to retype your FFXI PW.
 
I'm using AVG and it found a Trojan from Ares Destiny (it's so deleted when it's done scanning).
 
funny how everyone start to worry about their safety now ;p
 
Did a double check. i'm infected too. off to the ps2!
Where the bloody hell do I go to change my PW on ps2? I've never had to change it before.
 
Last edited:
Just gotta cover your bases. I found it interesting that Trend Micro didnt find what AVG has found.
 
I've been using a program called spysweeper for a long time and its worked well for me in the past. I did the search and didn't come up with anything so I guess I'm clean but I'm scared as hell after reading this post.
 
Using AVG now. Had a Trojan, but not one of the listed ones (I use Mozilla, and added the AdBlock and ScriptBlock add-ons today). Going to manually check for the keyloggers mentioned in this thread after the scan, just to be double-sure. I'll be damned if anyone jacks my shit.
 
AVG didnt detect the one i know i have ...Damn it trying bit thing now
 
i'm fairly slow on this...but when i did the regedit and hit browse on run, i clicked my comp but didnt see an edit button just the space where you insert the file to open...

i did a search with the in3.dll/kb1ss1p.dll/rsbo.exe for all files i didnt see in in the results am I safe?
 
Any recommendations on a good firewall? I have a router, but I don't have a software firewall though and I know most people recommend both for added protection.
 
Khidir said:
i'm fairly slow on this...but when i did the regedit and hit browse on run, i clicked my comp but didnt see an edit button just the space where you insert the file to open...

i did a search with the in3.dll/kb1ss1p.dll/rsbo.exe for all files i didnt see in in the results am I safe?
Click to expand...

double check the individual file names that dayner posted. the full path you did didnt show up on my search but when i double checked the names i found the keylogger+ 2 extras means I cant really trust my pc to not have any hidden on another name. (I use Avast! antivirus and it wasnt detected despite 5 fullscans in the last 3 days.)
I can live without the windower macros but those bastards took away my ability to parse! I was collecting data from my thf parses to have something proving that my thf can do actual damage with screeenshots of the player's gear so noone could claim the DD's were gimp.(nothing makes me happier than starting a party and being ignored in favour of an Ah Cannon DD that I can beat in damage by 50-100%.)
I cant even collect more data on my war as I merit it more to see how it improves when I add job specific merits.
 
Last edited:
Did another run i must have missed a step i'm going to bold this

SEARCH DOESNT WORK FOR PICKING UP THE FILES EVEN IF YOU DO SEARCHES ON ALL 3 FILES

I just redid the setup and found all three on my comp, I knew I must have gotten them last night when I got that antivirus pop up

ninja edit: I gave them all the banhammer too=P

Edit:

Last night me and nifal were farming, did a search on ffxiah for an item I get the message

"Click to run an activex control on this page"

I click no(stupid mistake?)

I get another box

"Your computer may have infected files, PC freezes,etc. etc. do you want to install Mimex(something like that) recommended.

I click no, my comp lags a bit and then I'm fine I still didnt feel everything was right though

Next day I see this thread, I did a search for the sys, dll, and the other one (copy and paste) in the all or part of file(top) and set it to my computer

no finds on any of them, I also used the in3.dll/kb1ss1p.dll/rsbo.exe in the search function again for my computer still no results.

I followed the run command as followed in the OP and I found all 3 files on my comp a second time(messed up the first so i relyed on search)

in short search cant find hidden files, run will
 
Last edited:
Khidir said:
Did another run i must have missed a step i'm going to bold this

SEARCH DOESNT WORK FOR PICKING UP THE FILES EVEN IF YOU DO SEARCHES ON ALL 3 FILES

I just redid the setup and found all three on my comp, I knew I must have gotten them last night when I got that antivirus pop up

ninja edit: I gave them all the banhammer too=P
Click to expand...

Um? More info please.
 
if windows search leaves anything out, you can always do nifty dos commands.

start>run>cmd.exe

c: (if you arent already on your local c:\ drive)
cd\
dir /s rsbo.exe
dir /s filenamesgohere.exe
 
I'm clean ;D

I'll run the AVG thing incase anyways
 
Khidir said:
Did another run i must have missed a step i'm going to bold this

SEARCH DOESNT WORK FOR PICKING UP THE FILES EVEN IF YOU DO SEARCHES ON ALL 3 FILES

I just redid the setup and found all three on my comp, I knew I must have gotten them last night when I got that antivirus pop up

ninja edit: I gave them all the banhammer too=P

Edit:

Last night me and nifal were farming, did a search on ffxiah for an item I get the message

"Click to run an activex control on this page"

I click no(stupid mistake?)

I get another box

"Your computer may have infected files, PC freezes,etc. etc. do you want to install Mimex(something like that) recommended.

I click no, my comp lags a bit and then I'm fine I still didnt feel everything was right though

Next day I see this thread, I did a search for the sys, dll, and the other one (copy and paste) in the all or part of file(top) and set it to my computer

no finds on any of them, I also used the in3.dll/kb1ss1p.dll/rsbo.exe in the search function again for my computer still no results.

I followed the run command as followed in the OP and I found all 3 files on my comp a second time(messed up the first so i relyed on search)

in short search cant find hidden files, run will
Click to expand...

Hm. Please show me the registry entries where the 3 files are located.
If they're located in:
[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5647]
That means you searched for the files through Windows first. Those are Search Assistant entries of past search history.

This is the reason why I need you to be specific. If they are indeed in the \Microsoft\Search Assistant entry, you are clean.

The file rsbo.exe automatically creates the .sys and .dll files each time you login. They are stored in the windows\system32 directory. They inject themselves into the windows processes and remain hidden from "most" antivirus protection. Norton, McAfee, and Trend Micro did not find this trojan. The only software that found it was AVG Pro.
Click to expand...
 
AVG and the bit defender thing both didnt find the files , but i know they are there

This is what i see in the search thing

Default REG_SZ (Value not set)
000 REG_SZ win32
001 REG_SZ rsbo.exe
002 REG_SZ direct x


Anyone KNOW of a prog that can remove this if this is a keylogger?, If so where is it

or can i just try and delete these ?
 
You must log in or register to reply here.
Back
Top