Re: Spyware which tracks keystrokes?

From: Susan (none_at_this.time)
Date: 03/25/04 

Date: Wed, 24 Mar 2004 22:04:57 -0500

On Wed, 24 Mar 2004 09:38:53 -0500, Dulcie wrote:

> "Susan" <none@this.time> wrote in message
> news:1061rklh8i4uoea@corp.supernews.com...
>>
>> Without installing any software to find it for you, you can probably
>> see the running eBlaster executable by doing <ctl-alt-del>.
>
> What would it be called on the 'Close Program' list? Any idea? I don't
> know what half the things listed in the <ctl-alt-del> window are, tho
> some are obvious.

probably eBlaster or something synonymous with spectorsoft

>
>> Alternately, you can run msinfo32:
>> Start>run>(type msinfo32)>enter
>> If you are given the choice to choose "Advanced", then do so. Expand:
>> "Software Environment" and highlight "Running Tasks". Look for the
>> executable here. <
>
> Interesting!
>
>
>> eBlaster may be a combination of these files:
>> rmashlex.dll, nvrcr32.dll, eblaster.exe; msrac32.exe, ebsetup.exe,
>
> I guess an ordinary search would dig those out then...

yes

>
>
>> it also creates these registry keys:
>>
>> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
>> ShellServiceObjectDelayLoad\XmLdrKLocation =
>> {0C887F38-5178-43DA-B9F0-B856141FCDA4}
>
>>snip>
>
> How do I find registry keys?

If you didn't find the eBlaster executable then there is no reason to
fiddle in the registry. However, I can see that you're interested in
learning and that pleases me, so with the group's indulgance, for this is
moving away from security issues, I'll offer this...,

Again, use the run command and type in "regedit". You'll be presented
with the registry folders tree. Expand and browse as you see fit but, be
very very careful here Dulcie! You can hose your box royally in there.
"Look but don't touch" as it were.

>
> Many thanks Susan - I appreciate all that info :o)

You're quite welcome Dulcie ;]

-- Susan
  sazy

Relevant Pages

  • reply
    ... >tried deleting it from the msconfig Startup tool system, ... neither the listed name or command line name ... First, ME comes with a registry backup application, try ... folder temporarily by using attrib.exe: ...
    (microsoft.public.security.virus)
  • Re: 890830 MSRT keeps wanting to download
    ... Have saved a new 890830 to disk and tried running in safe mode. ... PS I have been using a PC for years but delving in to the registry is a new ... If the tool did not scan the computer successfully, try installing it from ... I have just had a prompt to download updates and guess what it ...
    (microsoft.public.windowsupdate)
  • Re: dvdrw disappears
    ... I will have a look in the registry at some stage. ... Try putting your DVD writer in Ultra DMA mode 2 and remove UDF reader as ... I have not had roxio installed since installing XP late last year ... controllers like Promise or Highpoint, ...
    (microsoft.public.windowsupdate)
  • Re: Modify Registry on all SBS2003 clients
    ... registry setting to all workstations. ... command "REG ADD" to modify registry. ... the following command will change the registry value as your ... You may copy above command into the login script file SBS_LOGIN_SCRIPT.bat ...
    (microsoft.public.windows.server.sbs)
  • Re: ZoneAlarmPlus log viewer BUG
    ... Initially my system date was incorrect Oct 4 2002 the vendor when installing ... Other than clearing out the registry records I have uninstalled twice now ... which included deleting the zllictbl.dat file in the Windows System folder. ... Internet log folder but no longer is there the backup file and the ...
    (comp.security.firewalls)