Key Loggers

Zepol · Post by **Zepol** » Mon May 07, 2007 1:26 pm

Hello All,
I have put a project upon myself to see how I can stop these intruders of privacy.
What many people dont know is how these KeyLoggers work and how did they start. Keyloggers are actually legit programs that have turned ugly. Companies use these keyloggers to track there employees work, were they go, and what they say. Think about like monitoring phone calls for quality assurance.
But these viruses are they same program but modified for the person that is requesting the info.
So first things first how can you know if there is a keylogger on your machine well its simple. Right now the known process that you should keep an eye out for are:
- svch0st.exe (This is your most common one)
Please do not confuse this one for svchost.exe which is a legit Windows process

**To check your process's, just hit ctrl+shift+esc and it will pop up your windows tsk manager. Select your Processes tab and walla.

I will keep updateing this as I come around more and more.

My best advise for you right now is turn on saveing passwords and autofill in's. Remember this keylogger can do much more damage then just stealing your wow account for example, it can store you credit card info, social security info, current home address info, date of birth, Drivers License, and much much more....basically if that hacker really wanted to do some damage to ya, they can take over your life and apply to new credit cards and open bank loans....just putting it to a extreme but things like this have happened.

On wow just turn on your "Remember Account" button which is located on the bottom left hand side of you WoW welcome screen, this will store your account name. And if you really would like to be safe put a new text doc and put your password there. So everytime you need to log into your account just simply open that new txt doc and copy paste your password.

Please becarefull with what you download if there is a new user posting up some new addon do not download it, you might not be sure if that might contain a possible Keylogger.

To many people that i know have been burnt by these basterds and I cant stand seeing another good friend going threw some BS that Blizz should of handled.

Take Care
Al

Oh PS lol
If you would like to see a MTV documentary on these gold farmers enjoy this 5 mins flic =D
http://www.mtv.com/overdrive/?name=news ... vid=120059

Bladesinger · Post by **Bladesinger** » Mon May 07, 2007 2:40 pm

Does multiple svchost.exe programs running at the same time indicate keylogger programs running? I think I've got 6 or so at any one time.

Zepol · Post by **Zepol** » Mon May 07, 2007 3:02 pm

those are fine, they can be fully trusted.
But as soon as you see one with a 0 instead of a o ...end the process ...and change your password/s

Yukirina · Post by **Yukirina** » Mon May 07, 2007 4:46 pm

zepol i'm extremely happy taht u made this post to make everyone aware of keyloggers and the such i also did research about it being a recent victim and came to the same conclusions as u did... keyloggers the bad ones are usually assoiciated i think with trojan viruses as they are the ones that lower your secrurity system without u knowing and also installing keylogger software in your system32... that even if u stop the keylogger process the trojan or the software it encoded in your computer will just reinstall back on your computer the next time u restart your computer

Zepol · Post by **Zepol** » Mon May 07, 2007 7:03 pm

=D Thanks Yuki,
Sorry from bringing this topic now after the math, its just i didnt think that it was happening too often up until yesterday that i found out that Kikki's account got hijacked aswell is when i noticed that the issue was rising. So far 4 people that i know have been hijacked, and to me thats one to many.

As far as the svchost.exe just incase you would like to know what it is for I got the defenition from the root source...lol the MS website
svchost.exe is a system process belonging to the Microsoft Windows Operating System which handles processes executed from DLLs. This program is important for the stable and secure running of your computer and should not be terminated.

Lilleth · Post by **Lilleth** » Mon May 07, 2007 9:51 pm

Thanks Alan, I am clueless when it comes to this stuff...I wouldn't have known what to look for. Just checked, and all looks legit on our end.

PS...due to copyright laws, I couldn't watch your MTV video outside the US lol! Or so the friendly warning told me...

Stracius · Post by **Stracius** » Mon May 07, 2007 11:45 pm

SSX-Bladesinger wrote:Does multiple svchost.exe programs running at the same time indicate keylogger programs running? I think I've got 6 or so at any one time.

Multiple are normal, nothing to be worried about. I usually see about 4-6 running at any one time on my machine, and I know it's clean

.

Zepol · Post by **Zepol** » Tue May 08, 2007 6:43 pm

I found a intresting article from BBC
http://news.bbc.co.uk/1/hi/technology/6526851.stm
Too bad windows made another hit and a miss

QuantumDelta · Post by **QuantumDelta** » Wed May 09, 2007 5:39 pm

Generally speaking ctrl-alt-del and check all running processes, identify the ones you don't know with a little googling and see if you need to remove them / run checks on your PC.
After any software changes, and when you start your wow client are good times to check such things subsequently, as long as you're good at segmenting what you're doing on your computer (read; updating/surfing/scanning for new stuff/playing/working) you normally get full chance to stop anything before it can even keylog you in the first place :X

Post by **Inquisitor** » Wed May 09, 2007 6:27 pm

Don't be afraid to pick up the phone and call your computer or antivirus software's manufacturer for tech support.

You paid for it, you should use it.

If you download ANYTHING from the Internet, make sure you have up to date AV installed at the very least. Its cheap, and even at its price it may save you hours, days or weeks of heartache.

Be careful out there, trust nothing you download until you can verify its source, including anything so called "friends" you met online may send (or appear to have sent) you.

Use the security features in your browser, IE has popup blockers, and script execution controls, so does Firefox, make sure those are turned on, and only turn them OFF for sites you are 100% sure off (my work email, for instance, is a Trusted site). Never click on a download URL from an IM, always cut and paste it manually into a browser, and always look to see if the URL actually matches the text that hides it.

When in doubt, don't.