Member Panel

This is the results of my prework test.hijackthis.log

January 23, 2007.txt

Hi Marioc,

Upgrader isn't one of our Security Team, but I am sure he will be flattered, LOL. Please post the AVG log that came from the PreWork as well please. Then one of us will be in a better position to help you find your keylogger.

Looking foward to your reply,

TTFN

LGW

Hey Mario,

I have a couple of questions for you, first of which is whether you knowingly have Internet Information Server running on your PC, I see no indication of Personal Web running under processes.

Also, did you at one time install and uninstall Starware onto this PC?

Do you recognize this IP address? 127.0.0.1

Also, if you have not installed Morpheus (which leaves you quite vulnerable to attacks, virus', spyware, etc.), it is possible that your girlfriend has and is somehow gaining access through that vulnerability. We highly reccomend uninstalling p2p software, especially those with known spyware links such as Morpheus.

OK here may be the potential payload,
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
I need to do a bit more research on this, but I will have directions for you in the morning.

Looking forward to your reply,

TTFN

LGW

The first question...I don't know. The second...yes, I have starware on there now. What p2p software are you referring to? Where and what is Morpheus? What IP address is: 127.0.0.1? I thought I posted the AVG log?

Hi Mario

Morpheous along with Limewire and Kazaa etc is a P2P (peer to peer) file sharing program which is wide open to malicious exploits.
I am moving this to the HJT Logs forum as the attachment you provided is an HJT Log.
A HJT log expert will assist you as soon as possible. Please bear with us, Thanks.

Ok. I'll be waiting.

Hey Mario,

I'm not seeing the AVG log, can you please post it again? As far as the Morpheus, it's possible that your friend installed it on your PC, or it is equally possible that she infected you in order to gain access to your passwords. Regardless of where it came from, Morpheus is probably good to remove, so uninstall that from Add/Remove Programs, and then once I take a look at your AVG log, we can start determining if the Satiloler Trojan is the culprit.

Looking forward to your reply,

TTFN

LGW