*update* IMPORTANT: how to check to see if your PC has been keylogged.

Goto your C:\Windows\System32\ and look for rsbo.exe, kb1ss1p.dll, and kb1ss1p.sys

If they are there, restart your computer in Safe Mode and delete all 3.

Trojan Type:

Agent.GDA type

Files:

C:\Windows\System32\rsbo.exe
C:\Windows\System32\kb1ss1p.dll
C:\Windows\System32\kb1ss1p.sys

Registry Key:
{ED0ACB58-556F-21DA-DDFE-6D20F3F611BB}

The file rsbo.exe automatically creates the .sys and .dll files each time you login. They are stored in the windows\system32 directory. They inject themselves into the windows processes and remain hidden from "most" antivirus protection. Norton, McAfee, and Trend Micro did not find this trojan. The only software that found it was AVG Pro.
Click to expand...

This guy says only AVG Pro found them for him, which costs like $40...
 
how do i take screenshots on my comp? i'll upload them for you

they're already deleted but i havent restarted yet
 
Hit Print Screen and paste it into an image editor program, like MS Paint.
 
Ok i looked in the Windows/win32 file thing like you said but cant find any of those files ..are they in a diffrent folder in that set or in that huge list of files under the folders?
 
Sweet, I'm off the hook (didn't find it on my comp).
 
MissKittyKat said:
Ok i looked in the Windows/win32 file thing like you said but cant find any of those files ..are they in a diffrent folder in that set or in that huge list of files under the folders?
Click to expand...

Does your registry look like this? This means those files are located in:
[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5647]

registry02is5.jpg



If that's the case, you're not infected.


Khidir, you're not infected. Notice all the other names under data? Those are terms you have searched using Windows Search function.
 
Oh snap! Looks like keyloggers wasn't the only thing Khidir was searching for >_> <_< LOL
 
so if i was infected they would be in the windows 32 folder correct? the screen you see was after i deleted the 3 files mentioned in the OP

nin edit: honestly...I dont know why those items appeared in that folder, sex...ffxidat collection

not stuff i frequently use...it must have been stored for a long time

and i think i just deleted the stuff that belonged to my jukebox >_>;
 
Last edited:
Khidir said:
so if i was infected they would be in the windows 32 folder correct? the screen you see was after i deleted the 3 files mentioned in the OP

nin edit: honestly...I dont know why those items appeared in that folder, sex...ffxidat collection

not stuff i frequently use...
Click to expand...

That's correct. You're off the hook! For the Trojan at least. :D
 
So if its under search assestent thing ...i am ok?


PLEASE say yes omg i was so scared i just got a hauby too

Scared the shit out of me
 
MissKittyKat said:
So if its under search assestent thing ...i am ok?


PLEASE say yes omg i was so scared i just got a hauby too

Scared the shit out of me
Click to expand...

Yes, you're not infected if it is indeed in the Search Assistant entry. Do you know for sure?
 
When entering a password, type the last letter, click with your mouse (KEYLOGGERS DO NOT DETECT MOUSE CLICKS) to the front of those letters, enter in more letters, and repeat. Doing this results in a jumbled password that the keylogger will grab and it will not be your password.
 
exodusamphi said:
(KEYLOGGERS DO NOT DETECT MOUSE CLICKS)
Click to expand...

Yes, they do detect your mouse. They can also record images on your screen.

Edit: This is still the best alternative to type your password. Like you said, there's no proof that this trojan can record your mouse activity.
 
Last edited:
Dowzer said:
Yes, they do detect your mouse. They can also record images on your screen.
Click to expand...

Mabye high end keyloggers, most keyloggers do not detect where your mouse has clicked, so it is a safe idea for the most part, I guess some research needs to go into this to determine if this particular logger can record images of where you have clicked...

Also, if you dont like FireFox try Opera internet browser, it is just as secure if not more than FF, and definatly more secore than IE.
 
Last edited:
If your password is stored, are you safe?
 
I'm not certain.
 
This is nuttso I have to enter my PW each time i log on. Once i klik login theres a stored PW there and then it asks me for a different PW of 8 or more characters like a second PW for backup security...Does everyone else have to do this? I feel like running home to check this nonsense trojan/keylogger stuff. Thanks for all the advice everyone.
 
Whew I read about this during school so when I got home i set everything up searched and found nothing, Boy am I glad.

But, thanks for the Advice on how to protect us.
 
You must log in or register to reply here.
Back
Top