ICQ Keylogger

Hello all, long time reader, first time poster.

Have a bit of a concern. Recently I ran my weekly XoftSpy scan and found an instance of SpyArsenal ICQ Logger. It shows it to be a registry entry at this location...

"HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PSSdk21\enum\0::root\legacy_pssdk21\0000 "

After cleaning it, and then even removing the backup file that XoftSpy creates it doesnt show up on any scan. That is until you reboot. Ive tried running in safe mode and removing it, with the same luck. I just cant find the file that keeps renewing it. No other av or asw program has picked it up but XoftSpy.

Help is more than appreciated. I can UPS someone some cookies if they can keep me from reformating.

Thank you for any and all help.

David B.

 

Hk and welcome to WindosBBS forums.

Well XoftSpy certainly seems to be producing quite a few interesting 'results' to say the least. This must be the 4-5 one this week.

Lest do some digging and then get a HijackThis! log file please. Also please let me know what, if any type of unusual activities or malware symptoms you're experiencing.

Here is how we like to begin our analysis of your pc:

For starters, if you do not have them yet, please DL and run AdAware & Spybot Search & Destroy.AdAware and Spybot Search & Destroy are 2 of the most trusted apps in the security area. They are both free, compliment each other nicely, and do not use a lot of resources. They can be found here:

Spybot Search & Destroy v.1.4
AdAware SE Free v1.06r

With AdAware and Spybot: DL, follow the install instructions, check for updates, then scan, repair/remove/quarantine anything found. Reboot before next scan with whichever app is next. The reason for running these apps, is to clean up some of the other 'crapware' on your pc, which, in turn, will make deciphering your HJT log, easier.

Then we use HiJackThis v:1.99.1zip.
DL the zip file to your desktop, then create a new folder on your C drive, called 'HJT' or 'HijackThis'. Then unzip the files to the new folder. When you run HijackThis.exe from C:\HJT folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary which is easily accessible.

Run the program, and press Scan. You will notice the Scan button will turn into a "Save Log" button. Save the log and Post that log onto this topic. DO NOT DELETE or modify anything yet, as some of it is needed to keep your system in proper working order.

 

Both Adaware and S&D came up clean. There havent been any adverse effects that havent somehow cleaned themselves up.

Last Friday I could not whatsoever connect to the internet, but my bandwidth monitor was still showing activity. Called my SP up and we troubleshot (or shooted) for the next two days. Finally I gave up bought a new modem and NIC card thinking those might be the reason. Ran some scans, deleted some files (dont recall which) and then like a miracle the I was able to connect to the internet. Only thing now, still get the ICQ Logger every time I reboot.

heres the log

-----------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 8:38:40 PM, on 7/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newzbin.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.newzbin.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.newzbin.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: MCPClient - C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll
O20 - Winlogon Notify: WBSrv - C:\PROGRA~1\Stardock\OBJECT~2\WINDOW~1\wbsrv.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

Thanks a million for taking the time.

 

Wait, I take that back AdAware came up clean, S&D just showed an instance of Prorat-D.

 

I don't see anything in the logfile, please post the specific Spybot results, thanks.

 

It was referencing the same registry file(s) that XoftSpy showed.

HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\PSSdk21\en um\0::root\legacy_pssdk21\

I had S&D delete them, removed the backup file and upon this last reboot XoftSpy finds the same thing as usual ICQ Logger and S&D and AdAware find nothing.

Very interesting.

 

OK, I'm going to do a little more looking around tonite, but I'm fairly certain this isn't any threat, just a false\positive.