Buy Malwarebytes antimalware
Google
The Spykiller
  Home Help Search Calendar Login Register   *
Board Language: Deutsch English
Advertise on this site
  • This is just a place to upload files that have been asked for from other forums.
  • Please start a new post and Just give a link to your posts on the other forum & then press attach and upload the files.
  • Files can be uploaded by anybody but not seen or downloaded by anybody except for those users that have been given special permissions
  • You DO NOT need to be a member to upload, anybody can upload the files
  • DO NOT post Hijackthis logs in this forum as they will NOT be dealt with, Please post in the Help & advice forum

    Only Authorised users can see the files once they have been uploaded You WILL NOT see them

Digg This!
The Spykiller  > Spyware & Malware removal and General computer help > Uploads > Topic: whclient.exe => keylogger ??
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: whclient.exe => keylogger ??  (Read 639 times)
0 Members and 1 Guest are viewing this topic.
Thunder
Authorized Users
*****
Offline Offline

Posts: 29
« on: March 02, 2007, 18:34:25 »
whclient.exe (user suspects keylogger activity)

Strings seem to show hints to this being a keylogger ??

Jotti :

File:  whclient.exe 
Status:  POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.) 
MD5  62cfd0ddcfb39f1f3603c3e849e08329 
Packers detected:  -
 
Scanner results 
Scan taken on 02 Mar 2007 18:19:07 (GMT) 
AntiVir  Found HEUR/Malware 
ArcaVir  Found nothing
Avast  Found nothing
AVG Antivirus  Found nothing
BitDefender  Found nothing
ClamAV  Found nothing
Dr.Web  Found nothing
F-Prot Antivirus  Found nothing
F-Secure Anti-Virus  Found nothing
Fortinet  Found nothing
Kaspersky Anti-Virus  Found nothing
NOD32  Found nothing
Norman Virus Control  Found nothing
Panda Antivirus  Found nothing
VirusBuster  Found nothing
VBA32  Found nothing
 

VirusTotal :

STATUS: FINISHEDComplete scanning result of "whclient.exe", received in VirusTotal at 03.02.2007, 19:23:24 (CET).

Antivirus Version Update Result
AntiVir 7.3.1.38 03.02.2007 HEUR/Malware
Authentium 4.93.8 03.01.2007  no virus found
Avast 4.7.936.0 03.02.2007  no virus found
AVG 7.5.0.447 03.02.2007  no virus found
BitDefender 7.2 03.02.2007  no virus found
CAT-QuickHeal 9.00 03.02.2007  no virus found
ClamAV devel-20060426 03.02.2007  no virus found
DrWeb 4.33 03.02.2007  no virus found
eSafe 7.0.14.0 02.28.2007  no virus found
eTrust-Vet 30.6.3447 03.02.2007  no virus found
Ewido 4.0 03.02.2007  no virus found
FileAdvisor 1 03.02.2007  no virus found
Fortinet 2.85.0.0 03.02.2007  no virus found
F-Prot 4.3.1.45 03.01.2007  no virus found
F-Secure 6.70.13030.0 03.02.2007  no virus found
Ikarus T3.1.1.3 03.02.2007  no virus found
Kaspersky 4.0.2.24 03.02.2007  no virus found
McAfee 4975 03.02.2007 New Malware.d
Microsoft 1.2204 03.02.2007  no virus found
NOD32v2 2090 03.02.2007  no virus found
Norman 5.80.02 03.02.2007  no virus found
Panda 9.0.0.4 03.01.2007  no virus found
Prevx1 V2 03.02.2007  no virus found
Sophos 4.14.0 03.01.2007  no virus found
Sunbelt 2.2.907.0 03.01.2007  no virus found
Symantec 10 03.02.2007  no virus found
TheHacker 6.1.6.067 03.01.2007  no virus found
UNA 1.83 03.02.2007  no virus found
VBA32 3.11.2 03.01.2007  no virus found
VirusBuster 4.3.19:9 03.02.2007 no virus found


Aditional Information
File size: 73728 bytes
MD5: 62cfd0ddcfb39f1f3603c3e849e08329
SHA1: 231acfbcea554f68023b42a989729bac8dabc3d6


link : http://www.hijackthis.nl/forum/viewtopic.php?t=7456

[attachment deleted by admin]
Report to moderator   Logged
Whatever happens, make believe it was meant to be ...
Derek
Administrator
*****
Offline Offline

Posts: 11284
« Reply #1 on: March 02, 2007, 20:14:57 »
looks like a keylogger to me as well but I can't see any instructions to send any info out

has it been submitted to teh AV companies yet
Report to moderator   Logged
Derek
Microsoft MVP  Windows - Security
Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work and research to prepare the fixes for you. A large part of my time is spent helping you
Would you do all this for nothing?
 I run this site to raise funds for Hedgehog Rescue
Please donate if I have helped you or you have found this site useful.
Thunder
Authorized Users
*****
Offline Offline

Posts: 29
« Reply #2 on: March 02, 2007, 20:27:47 »
No, Derek,
that's your prerogative  Smiley

Just now, I received this from nosirrah :
Quote from: nosirrah
This connects to 85.105.47.210:10340 (cable.quicknet.nl) .

There are strings that mention keylogging as well as this interesting string :

AC:\Documents and Settings\Aciid f1ux0r\Mijn documenten\1337\Trojan\Reverse Connect test\Server\Project1.vbp

This file did continuously send information out so I think that it is safe to say that this is a keylogger .

I'll definitely have the user get rid of it.  Wink

Thank you, Derek  Cool
Report to moderator   Logged
Whatever happens, make believe it was meant to be ...
Pages: [1]   Go Up
  Print  
The Spykiller  > Spyware & Malware removal and General computer help > Uploads > Topic: whclient.exe => keylogger ??
 « previous next »
 
Jump to:  

Donations

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts


.

Useful Advice and Programs
  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog
Kaspersky online scanner
Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser
Stop killing hedgehogs with strimmers
User
Welcome, Guest. Please login or register.
Did you miss your activation email?
August 01, 2010, 03:31:00

Login with username, password and session length
secunia Software inspector

Google ads
RoboForm: Learn more...

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware is so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you.
In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

I run this site to help raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the PayPal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running
Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC
TinyPortal v0.9.8 © Bloc 		Valid XHTML 1.0! Valid CSS!
Page created in 0.094 seconds with 31 queries.

Google visited last this page July 19, 2010, 11:28:16