Cheat Engine

Burningmace · Posted: Mon Aug 10, 2009 7:24 pm Post subject:

Could you launch Process Explorer and view the info on dllhost.exe, then paste the parameters that it was called with here?

e.g: dllhost.exe /load something.dll

Haswell · Posted: Mon Aug 10, 2009 7:36 pm Post subject:

Thanitos · Posted: Mon Aug 10, 2009 7:52 pm Post subject:

System restore to BEFORE you got the virus or your last resort of reformating, I found with the temp folder viruses they were just easier to system restore or reformat

Haswell · Posted: Mon Aug 10, 2009 7:58 pm Post subject:

Not that I intend to keep the virus within my PC, but I could really learn something from its source code and the 'keepalive' process.

Thanitos · Posted: Mon Aug 10, 2009 8:03 pm Post subject:

Alright, those are just the ways I used, but good luck

Hero · Posted: Mon Aug 10, 2009 8:31 pm Post subject:

Delete cookies, temp folders, and system volumes back dating to when it started. if its backing up in any of these places it wont go away. It may also be locating in system folders.

WhiteByte · Posted: Mon Aug 10, 2009 11:07 pm Post subject:

Record Packets with wpe pro or any efficent packet editor. Turn on all av's and firewall protections. When you find the ip use whois to discover more info about the originating location. I may be wrong but this might help.

Haswell · Posted: Tue Aug 11, 2009 12:15 am Post subject:

WPE Pro records packets within a specific process, and I still don't know how the virus got in. AV and firewall is on and running.

Still waiting for the virus to pop up again so I can root the rest out.

Thanitos · Posted: Tue Aug 11, 2009 12:27 am Post subject:

Whats your OS, fire wall, and virus software?

Haswell · Posted: Tue Aug 11, 2009 12:45 am Post subject:

XP Home Edition SP3, Outpost Firewall, AVG 8.5 Free.

Luigi · Posted: Tue Aug 11, 2009 12:50 am Post subject:

Thanitos · Posted: Tue Aug 11, 2009 5:15 am Post subject:

Ugh AVG should be considered a virus it self, you should look for a torrented version of Avast! or, my favorite, Eset nod32. I used a fire wall called ZoneAlarm, that is a good firewall.

Haswell · Posted: Tue Aug 11, 2009 5:18 am Post subject:

No warez. (hint hint)

I tried ZoneAlarm once. For every process I try to run it keeps asking me for permission. Based on this inconvenience, I uninstalled it.

1.5 hours to go until the anticipated time of the virus launch.

Haswell · Posted: Tue Aug 11, 2009 7:58 am Post subject:

20:30 passed without a hitch. I guess either the attacker quit, or he used an exploit in uTorrent, which I didn't run today.

Problem solved, requesting lock.

Burningmace · Posted: Tue Aug 11, 2009 9:23 am Post subject:

Glad to see you solved it Smile