Curse

Songbringer · Apr 10, 2008, 05:47 PM // 17:47

I don't know if this is where it belongs. I just wanted to say I found a keylogger on my computer and I believe it was through one of the texmod's I downloaded off of wiki site. I never had my guild wras password changed or anything. Nothing was ever missing. However I just wanted to let everyone know what programs I used that had to do with guild wars to let people be altered in case they want to watch out. I used Team Builder, a Guild Wars Freaks program that just allowed me to follow my characters and make builds for them. 3 different texmod's- Tyrian Cartographer/HFFF Aid/I don't remember then name of last one but it showed when health bars were below 50% on the party window. It also changed spirits to the color neon yellow.

I thought I would share incase anyone else uses any of those programs they can check there computer. I had my computer set to run daily checks of spyway and virsus scanners and neither found the key logger. I have had all those programs for months. It may have been something else but I haven't installed anything lately. I ended up force running Spy Sweeper and it found the keylogger and removed it. However I felt as I should reformat my computer because I am paranoid like that.

This was probably useless and no one will probably care however I felt as I should let the community know incase anyone else uses any of those programs to "enhance" there gameplay. Want everyone to be safe!

Siirius Black · Apr 10, 2008, 06:30 PM // 18:30

Wow, I downloaded the same files, but I coud not find anything wrong with them.
What did you use to locate the keylogger?
I usually rely in my antivirus and firewall and spybot/adaware to keep my computer clean.

Chthon · Apr 10, 2008, 06:37 PM // 18:37

Texmod .tpf files cannot contain executable code. They are raw data only. Unless you were a complete idiot and downloaded and then manually executed an executable mislabeled as a texmod mod, there's no way you got a keylogger from them.

The Texmod program itself is an executable, but the original exe contains NO malicious code. The only way you could have gotten a keylogger from Texmod itself is if you downloaded a modified copy from an unreliable source. Where did you download it?

I don't know anything about Team Builder. I would presume from reputation and presence on guru that they are legit, but I could be wrong.

My very strong suspicion is that either (1) you've been using some other third-party programs that you neglected to mention, or (2) you picked it up by visiting a malicious website that exploited a weakness in your browser, probably IE, to install the keylogger.

Songbringer · Apr 10, 2008, 06:56 PM // 18:56

I use mozzila and no I mentioned all the third party programs I use(atleast that I am aware were on my computer) I mean I have other games but no seperate prgrams for them. As for team build I got it from here and I downloaded the texmod's from the wiki anet put out. Team builder is just a program that has all the skill icons and desricptions)except for a few like Save Yourself cause they haven't updated it yet(or mine wasn't updated to have them). It just allows for 1-8 man party builds to be made so that a group of people can see all the bars at once and give an easier explantation of what everyone is supposed to do.

I used a Spy Sweeper program to find it. That was all it was called on the box(which the geek squad guy installed at best buy). However I had a firewall and anti virus program as well.

As for the website. I don't know what websites would have done that. I usually am on guru or wiki or pvx. The occasional buisness sites(for work and school) and sports sites. I go to the occasional game site with those crappy little browser based games. That could have done it maybe?

O and know I didnt edit any of the Texmods or try to make my own. I am not that computer savy. I had to call my brother just to figure out how to reformat my computer.

O btw the only reason I found it was because all my desktop icons would blink eveyr 12-20 seconds and it would minimize any programs I had running. That started while I was playing Guild Wars(not using any texmods or any other programs. even my like web broswer which I am constantly going to while I play). I figured it was a virus which had come through an email or something so i ran virus and spy sweeper and set my firewall to max protection.

Then called my bro who just said to follow the "quartine" procredure on Spy Sweeper. Which when it was done scanning it said found xx thing(the keyloger wich also had some wierd code behind it) Then I clicked quarintine and I told him I wanted to reformat my comp and he said ok get the disks and well you get it.

Edit: I checked around on all the programs I used for guild wars to make sure 1 they were allowed and 2 that other people had used them and had not had any problems. That is the only reason I downloaded them in the first place. Which I am hoping someone will say no stupid those had nothing to do with it. So I can feel safe and get my HFFF texmod back. ^^

Tarun · Apr 10, 2008, 07:15 PM // 19:15

Spy Sweeper is no good and often has a lot of false positives, which is most likely what you found.

If you're concerned about a keylogger then you should have the following:

Firewall - I recommend Comodo Firewall Pro.
Install programs like Malwarebytes Anti-Malware, Spybot S&D, Windows Defender and a good anti virus like Avast.

You should also refer to a PC Maintenance guide to ensure your computer is clean. - http://wiki.lunarsoft.net/wiki/PC_Maintenance
Then be sure to help secure your computer by reviewing a PC Security guide. - http://wiki.lunarsoft.net/wiki/PC_Security

Songbringer · Apr 10, 2008, 07:18 PM // 19:18

Quote:

Originally Posted by Tarun

Spy Sweeper is no good and often has a lot of false positives, which is most likely what you found.

If you're concerned about a keylogger then you should have the following:

Firewall - I recommend Comodo Firewall Pro.
Install programs like Malwarebytes Anti-Malware, Spybot S&D, Windows Defender and a good anti virus like Avast.

Haha well damn if it was a false positive....thats good but wata waste of time(its been like 2-3 hours of that -image command(or w/e it is considered) to redload everything for guild wars.

Thanks for recommendations I will look into them.