My experience with the maximo keylogger.

[tgiv014]

Okay guys, this is going to be easy or hard to get through(THATS WHAT SHE SAID) but people are working on a way to remove this. Personally im doing a system restore to yesterday and am going to edit this post with my results. By the way, does anybody know where i could find the keylogger program within a vista computer, because i seem not to have a conf folder(Yes i am also viewing hidden folders). If anybody knows about this, tell me please. I do know i have it though, because i have the firefox.exe always running in the background and restarting itself. It crashes every now and then too. That's either it or vista, i dont know whether i smell virus fail or vista fail...

Edit 1: Wonderful, my hard drive appears to have some file system corruption. I dont know if i had this already or if this was caused by maximo. Oh hey the keylogger crashed again lol.

Edit 2: Because of my hard drive corruption, and vista's gay inability to fix that (FUCK!!!!!!!!!!!!!!!!!), I have almost no way to fix this other than speak to maximo myself or restore completely with a new copy of vista. Sort of sucks that HP does not know how useful restore discs are, and decided not to include one with my PC. I also have the option still of installing windows 7.

[mastowns]

Go into C:\WINDOWS\system32\conf

Go to tools, folder options, view

Click show hidden files and folders, and unclick hide protected operating system files

You should now see WinHelp.exe.exe, Log, and Plugin.

Delete WinHelp.exe.exe and Plugin, you can view log to see how much of your information has been recorded

By deleting WinHelp.exe.exe and Plugin the virus will be completely remove and will never come back.

Your welcome!

[Remorse]

Go into C:WINDOWSsystem32conf

Go to tools, folder options, view

Click show hidden files and folders, and unclick hide protected operating system files

You should now see WinHelp.exe.exe, Log, and Plugin.

Delete WinHelp.exe.exe and Plugin, you can view log to see how much of your information has been recorded

By deleting WinHelp.exe.exe and Plugin the virus will be completely remove and will never come back.

Your welcome!

please stop copy-paste reposting that. it does not work. the virus is gone when he gets bored, so don't get any thoughts that you're a genius.

[Legify]

The easiest way is to Sys. restore, takes like 10 minutes.

Well, no I am wrong. The easiest way is to not run a hack until it is tested by a moron.

[tgiv014]

Okay, overnight my computer ran a hard drive consistency check and fixed itself to the point where i can now do a sys restore. I'm gonna do a restore and hopefully it will be done b4 i need to go to school.

[pipels]

Don't be a dick.
Most people don't know how to properly run a virus scanner, let alone things like HijackThis.

If most people do not know how to use a program then do not run anything file!
BTW, in the .net there are many tutorials or manuals about:
- disable system restore
- hijackthis
- combofix
read and learn to use them doesn´t take a long time.

[tgiv014]

System restore never fixed it, and yes i did use a restore point that was from before i got the virus. in the end i removed the virus using the following steps.

1. Shut down computer
2. Boot up in safe mode (Spam the F8 button while booting, for some comps it may be F2)
3. navigate to your C:\windows\system32\ (or C:\windows\system32\conf if thats where ur winhelper is located
4. Delete plugin.dat, winhelper.exe,and logs.dat(optional)
5. If you didnt delete the logs file, read it and check out what the virus recorded, its pretty interesting.
6. Clear out your recycle bin(not sure if this will affect the final result, just want to be safe)
7. boot up normally
8. check to see if there is a firefox.exe process running, while you are not running firefox
9. never repost these instructions, instead thank me and link anyone to this thread who needs help

I am running a 32 bit vista computer

[WarL0c4]

I had it and ill say only this StartUp check that and u ill no

[PyrexxHero®]

If most people do not know how to use a program then do not run anything file!
BTW, in the .net there are many tutorials or manuals about:
- disable system restore
- hijackthis
- combofix
read and learn to use them doesn´t take a long time.

Again, many people are too stupid to do that.

He put the virus on your comps for many reasons.
Mostly to trick you all.
Watch out though, he does have the potential to do you a LOT of harm.