jusaxin
Topic Starter
Hi and thanks in advance for any help you can provide. Firstly, I can’t run a Hijack log right now but I have posted the registry log created by Spy Emergency 2007 . If this isn’t the right place to post this question, would you be so kind as to move it to the correct forum?
Last night, Spy Emergency 2007 found a 5 issues on my computer, the 2 most troubling are called "Desware Spy works Components" and "Cybersitter". I live alone, so no one else uses or has access to my computer. There is someone that would have a strong motivation and desire to gain access to my computer so, when it started acting funny, I started really watching.
I ran AdAware, Spybot S&D, Windows Defender, AVG antivirus and I use the firewall with my Vista system. NONE of these caught a thing but I DL’d Spy Emergency 2007 last night and it found the following during the scan: Desaware, Cybersitter, IWON, Risktool.Reboot and Trusted Sites.
By my computer acting funny, I mean there have been programs running at odd times that I WASNT USING, like Microsoft OneNote, Outlook, WINWORD and IEXPLORE.exe (I could terminate everything but I couldn’t terminate iexplore.exe with Sysinternals Process explorer, AnVir First Aid Task Manager, or with Windows task manger. When I tried, they said the iexplorer process could not be terminated.)
I was not on the internet nor did I have an internet browser window open at the time iexplore.exe was running!! The thing is, NO software I've been using found ANYTHING out of the ordinary until Spy Emergency 2007 last night.
The 2 I am obviously most concerned with are CyberSitter and Desware.
Here is what the log had to say about these two item's infection signatures:
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8} (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\proxystubclsid (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\proxystubclsid32 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\typelib (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\typelib\version (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8} (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\proxystubclsid (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\proxystubclsid32 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\typelib (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\typelib\version (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8} (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\flags (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\0 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\0\win32 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\helpdir (RFC)
Infection name: Desaware Spy Works Components
_________________________________________________________
HKEY_CURRENT_USER\software\mimarsinan (RFC)
Infection name: CyberSitter
HKEY_LOCAL_MACHINE\software\mimarsinan (RFC)
Infection name: CyberSitter
I disconnected from the internet before the scan and haven’t been back on because, if they are keyloggers, I DONT want to tip off the person I’M POSITIVE had these installed remotely. I have 2 VERY IMPORTANT questions and I pray you can answer them, if you can’t, will you PLEASE pass them to someone that can help?
My future and the custody of my children might hang in the balance of what happens here!
1) Does this look like I have been infected with a keylogger(s).
2) If so, can the origins of the keylogger(s) that I have on my computer be traced back to the source of the install (install HAD to be REMOTE because NO ONE lives w/me) or is there ANY evidence that can be found on my computer or method that would allow me to trace the KL back to the point of deployment or, at the very least, would there be any evidence of where the keylogger info was being emailed?
If I'm not mistaken, purposefully installing a keylogger remotely to a computer that's not your own for the purpose of gathering private info is a federal wiretapping crime, is it not? Is there ANYTHING IO CAN DO to find out how this got on my computer??
I REALLY appreciate in quick reply you could provide!!
Thanks!!!
Last night, Spy Emergency 2007 found a 5 issues on my computer, the 2 most troubling are called "Desware Spy works Components" and "Cybersitter". I live alone, so no one else uses or has access to my computer. There is someone that would have a strong motivation and desire to gain access to my computer so, when it started acting funny, I started really watching.
I ran AdAware, Spybot S&D, Windows Defender, AVG antivirus and I use the firewall with my Vista system. NONE of these caught a thing but I DL’d Spy Emergency 2007 last night and it found the following during the scan: Desaware, Cybersitter, IWON, Risktool.Reboot and Trusted Sites.
By my computer acting funny, I mean there have been programs running at odd times that I WASNT USING, like Microsoft OneNote, Outlook, WINWORD and IEXPLORE.exe (I could terminate everything but I couldn’t terminate iexplore.exe with Sysinternals Process explorer, AnVir First Aid Task Manager, or with Windows task manger. When I tried, they said the iexplorer process could not be terminated.)
I was not on the internet nor did I have an internet browser window open at the time iexplore.exe was running!! The thing is, NO software I've been using found ANYTHING out of the ordinary until Spy Emergency 2007 last night.
The 2 I am obviously most concerned with are CyberSitter and Desware.
Here is what the log had to say about these two item's infection signatures:
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8} (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\proxystubclsid (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\proxystubclsid32 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\typelib (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{389b19b7-9a87-11d1-b77f-00001c1ad1f8}\typelib\version (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8} (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\proxystubclsid (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\proxystubclsid32 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\typelib (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{a834857c-9a90-11d1-b77f-00001clad1f8}\typelib\version (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8} (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\flags (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\0 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\0\win32 (RFC)
Infection name: Desaware Spy Works Components
HKEY_CLASSES_ROOT\interface\{0a4afe1d-f664-11d0-b649-00001clad1f8}\1.0\helpdir (RFC)
Infection name: Desaware Spy Works Components
_________________________________________________________
HKEY_CURRENT_USER\software\mimarsinan (RFC)
Infection name: CyberSitter
HKEY_LOCAL_MACHINE\software\mimarsinan (RFC)
Infection name: CyberSitter
I disconnected from the internet before the scan and haven’t been back on because, if they are keyloggers, I DONT want to tip off the person I’M POSITIVE had these installed remotely. I have 2 VERY IMPORTANT questions and I pray you can answer them, if you can’t, will you PLEASE pass them to someone that can help?
My future and the custody of my children might hang in the balance of what happens here!
1) Does this look like I have been infected with a keylogger(s).
2) If so, can the origins of the keylogger(s) that I have on my computer be traced back to the source of the install (install HAD to be REMOTE because NO ONE lives w/me) or is there ANY evidence that can be found on my computer or method that would allow me to trace the KL back to the point of deployment or, at the very least, would there be any evidence of where the keylogger info was being emailed?
If I'm not mistaken, purposefully installing a keylogger remotely to a computer that's not your own for the purpose of gathering private info is a federal wiretapping crime, is it not? Is there ANYTHING IO CAN DO to find out how this got on my computer??
I REALLY appreciate in quick reply you could provide!!
Thanks!!!
