- This topic has 13 replies, 8 voices, and was last updated 21 years, 4 months ago by
.
-
Posts
-
hi there! please help me with my problem. you see i got this unofficial chat client,(also i got it not in the site of the maker) its kinda new one. but after downloading it, i scanned it with Yahoo filesafe and Norton2005 and shows nothing to be alert.
when i run the application, it gives me a message “filename was changed” and the icon of the exe file in the desktop is gone. this chat client dont need to be installed, it can run alone. i thought it was an error of the application but when it tries to access the internet, i mean without me running the application anymore i was alarmed. im thinking this is kinda trojan. so i block all access of that client in my firewall setting. search for the file in my pc (yes its filename was chnaged) and deleted it.but even after doing that.. after several minutes it start to ask for internet access again i check on my task manager and that file is running, did a search again but nothing found, did a full system virus scan using norton2005 and a-squared gave no alarming result.
i have rebooted but again that application asked for internet access but cant be found when searched.
am i right in assuming it is a trojan? and what are the ways to remove it?
i would greatly appreciate any help.By the way, i hope this serve as a warning to others, :crying:
bettina.
Hey, welcome to BigBlueBall.
It sounds a bit dodgy to me.
Do you know the name of the .exe file, or the name of the potential virus?
Also, what is the problem with using an official chat client?
there is no problem using the official chat client. im just kinda curious about this so called chat client. the name of the exe file is the name of the chat client though to be honest, and as i said, it doesnt come from the official “underground site”. Well yeah this is the price i have to pay for that. But im seeking help on to remove such trojans. its weird for me that even though i have deleted that exe file, it still run without me running it.
actually the chat client name is chatkiller, its a chat client + booter in one. I got it from an unoffcial site since that chat client is a paid software. i think the trojan is binded to that exe file. coz everytime my PC is running, i would see the chatkiller.exe file in the processes. the measure i made for it not to give remote access is to block it thru my firewall and end process of that chatkiller.exe file in the task manager.
you see ti’s not safe to use chat clients that you got from booter sites…chances are, they’re keylogged or trojaned…discard it and use another client from a “clean site”…or better, use a reliable antivirus/firewall…
Dear bettina,
It would be great if you can provide me with the link to the program that you downloaded or you could put it up on a temporary hosting site and give me the link to download. I could analyze it, add it to my own proprietary antivirus software and provide you with the answer.
Norton…is crap in my opinion.
Use a program like nod32 with a low memory usage and small footprint.
you can check out nod32 at http://www.eset.com
And downloading a booter/client?…thats stupid.
if indeed its a keylogger there are programs out there to scramble keyhooks and other keylogging methods.
bettina wrote:actually the chat client name is chatkiller, its a chat client + booter in one. I got it from an unoffcial site since that chat client is a paid software.So first you’re downloading a chat client that you can’t verify the author, from a site that ISN’T run be the person who wrote it, and were downloading a pirated copy of the said client, AND it has built in booting capabilities which is probably what attracted you to it.
Normally I would be sympathetic but I find it hard to be given the circumstances. Perhaps you should just consider wiping your system.
hi. tnx to all replies. first, i came in this forum to seek help and not be lambasted. its my mistake yes, i had admitted it.
To Dermot, the move maybe stupid yes, but dont speak as if you have not commited any stupid move before. Again, I went here to seek for help.:mad:
To Oscar, if you had read my post, i am seeking for solutions and workaround not for sympathy.:rolleyes:
To SS_Antihacker, i will give you the link of the site when i found it again cause as of now the link is not working. Thanks anyway. 🙂
To moderators and members of Bigblue Ball, i apologize for this post. I just thought i would get help here and not be dressed down.
Well my friend that referred me to this site have solve my problem.
I just hope that next time, the “mentors” and “experts” in this forum will be a little considerate on what they are saying, but im not saying all.I thank you all, MartinBradley, SS_Antihacker, marl, Oscar and Dermot.
Bettina, sorry for your first bad experience here. I’m sure they all want to help you. Please do come back here when you need help with your problem(s). There are many great people out there, such as Oreo, she is very kind and helpful =)…ohh, almost forgot, hihi, me too…j/p =P
Good luck 😉
Well, Bettina people just felt they wanted to share their thoughts with you…They meant nothing bad by it…I personally use Norton 2005 and it works perfectly fine for me. And you are definately right, we all make mistakes when we first start on computers or even when we think we are experts. Just like SS_AntiHacker, I think you should not let some people’s comments stop you from coming, not everyone is as rude on here. Always feel free to ask any question you please. And follow this one advice always….NEVER download things from sites that you aren’t sure of…Go the the main downloading site provided. And you shall be okay. 😉
To the moderator, please forgive me for being off the topic already.
Hi again! I appreciate all the help from all of you.. and i know there are more good individuals here that are willing to help.
I just want to make an appeal to others that if someone seeks help, please help them without saying harsh statement. So that they wont hesitate coming back here. Its okay to say opinion but please dont post something not so good to read.
Also, we learn from mistakes. We must admit that we all learn when someone commit mistake.
Again i thank all of you here in Big Blue Ball for the warm and not so warm hospitality. Also, sorry again for being off topic.
thanks a lot and more power to BBB!!!
Ok, getting BACK On TOPIC!!! First let me explain how Chat killer is designed to work. Chat killer has an authentication process that it goes thru which goes out to the internet and gives the data of your computer and says yes you’ve registered, etc. and then loads the program.
The cracked version of this program does the same thing, however it cannot go out to the original server for authentication, so therefore that is changed to go to a different server to authenticate.
There are a few other programs like yahoofilesafe, and ps2 detector that are fantastic program to look for estrings and trojans.
So if you are asking is this suppose to happen, the answer is yes it does happen with the cracked version. If you’re asking how to get rid of the program itself, you need to remove it from your startup menu, AND probably from your registry;
If it still sits in your startup, it’s going to start up every time, if it’s in your registery then it will look for a file, and if not found create it.
Hope that helps.
- You must be logged in to reply to this topic.