I Need Some Keylogger Help

[Stg-Flame]

First off, seeing all of the posts about the new forums I am not sure if this is the right place to post about this type of stuff anymore. If it isn't, someone please redirect me to the correct forum.

Now to the problem. My brother was searching some sites about Diablo 2 LoD and clicked a link from Google about a Dupe Method. When he clicked the link to "Enter the Site" McAffe (sp?) brang up a Trojan entering his computer called: "keylog-perfec.dr". Since I put Avast Anti-virus on his computer so he wouldn't have to pay for McAffe anymore (He is letting McAffe service run out) it has caught more than McAffe has. However, with this Trojan he was unable to Delete, Quarantine, or Clean the File. It left him with little options left and without myself being present, he went ahead and ignored the warnings.

This is what I found in his My Computer which was never there before. I had him run KL-Detector which found nothing, yet those two files were never there before. Not only were they never there before, but their names worry me.

When I asked him what he did specifically before McAffe brought his attention to the Trojan, this is what he said:

Flame ???? says:
I Don't think so. Just try to remember everything about it

Hamster of Chaos says:
When I entered the site. it was all black except for one thing on it that said either "Here" or "Enter Site" I cannot remember because I dont pay that much attention to that stuff.
Hamster of Chaos says:
I hit it, a thing poped up said File blablabla, Open, Save, Cancel. I hit cancel and McAfee popped up with the virus

With all that being said, if anyone has any information about this it would be greatly appreciated as he needs his computer for work. I have searched around but to no avail, I have not found a solution.

EDIT: I found the website in question: www.klandiablo2lod.konin.lm.pl/ Do not click the "Here" button.

 

[mechBgon]

Originally posted by: Chaoticpenguin666
First off, seeing all of the posts about the new forums I am not sure if this is the right place to post about this type of stuff anymore. If it isn't, someone please redirect me to the correct forum.

Now to the problem. My brother was searching some sites about Diablo 2 LoD and clicked a link from Google about a Dupe Method. When he clicked the link to "Enter the Site" McAffe (sp?) brang up a Trojan entering his computer called: "keylog-perfec.dr". Since I put Avast Anti-virus on his computer so he wouldn't have to pay for McAffe anymore (He is letting McAffe service run out) it has caught more than McAffe has. However, with this Trojan he was unable to Delete, Quarantine, or Clean the File. It left him with little options left and without myself being present, he went ahead and ignored the warnings.

This is what I found in his My Computer which was never there before. I had him run KL-Detector which found nothing, yet those two files were never there before. Not only were they never there before, but their names worry me.

When I asked him what he did specifically before McAffe brought his attention to the Trojan, this is what he said:

Flame ???? says:
I Don't think so. Just try to remember everything about it

Hamster of Chaos says:
When I entered the site. it was all black except for one thing on it that said either "Here" or "Enter Site" I cannot remember because I dont pay that much attention to that stuff.
Hamster of Chaos says:
I hit it, a thing poped up said File blablabla, Open, Save, Cancel. I hit cancel and McAfee popped up with the virus

With all that being said, if anyone has any information about this it would be greatly appreciated as he needs his computer for work. I have searched around but to no avail, I have not found a solution.

EDIT: I found the website in question: www.klandiablo2lod.konin.lm.pl/ Do not click the "Here" button.

I'll check into the site and see what the malware seems to be. In the meantime, if he's logged into anything that his stuff could get stolen from it, such as his WoW account, PayPal, eBay, bank, credit card, etc, or email accounts that could contain password-reset emails for sites like those, then he should (1) log onto a known clean computer, and (2) reset the passwords for all of those resources as a precaution.

Back in ~10 minutes with whatever info I can get on the bad site and the malware...

 

[mechBgon]

k, I checked it out, and ran the Trojan Horse on a Win2000 installation in a virtual machine. Then I fired up AOL Kaspersky and had it scan for the malware. It removed it OK. I think maybe your bro should ditch the Avast and switch to Kaspersky. Make sure he fully configures it, including maxing out all the sliders to HIGH detection, and schedules a nightly re-scan.

For good measure, also have him run this every month: Secunia's checkup thingie. And he should make sure his Automatic Updates (in Control Panel) are set to full automatic, and if he happens to have Office software, he should hit Office Update repeatedly until he's got all the service packs and patches, and then visit again monthly.

Also, if he doesn't have any other firewall software, then get his Windows Firewall turned on.

 

[Stg-Flame]

Much thanks, I will make sure he gets this information.