My Testing Logs

Background Information

I believe I may have been infected with a keylogger as my world of warcraft account was recently compromised on two occasions, in addition to the associated e-mail account.


I've since solved the problem by changing passwords and e-mails on a computer known to be unaffected.

Find attached a copy of the most recent version of my logs.

I completed the the SAS and Malware Bytes testing a couple of days ago, so I hope I have located the correct log files.

Let me know if you require any additional information.

Other Info

The first time I ran combofix, it indicated that a rootkit had been detected, and subsequent tests after regular windows reboot would result in BOSD. The log attached is from a complete combofix scan that was performed in safe mode, which completed without any issues.

 

Here is the last file.

 

Kestrel13,

Thank you for your prompt reply.

To answer your questions:

C:\ASK Video contains one folder titled 'Cubase 5', and within that is one file without an extension titled CUB5L1-Reg. Cubase 5 is an audio program that I use.

C:\Program Files\Common Files\Tmp has no contents (no hidden files even). I recently wiped all my temp stuff using a tool I found on this website.

To give more background info regarding how I may have been hacked:

I highly doubt that I was phished, but it is entirely possible that some type of malware had infected my computer a couple months ago (when this first compromise occured) because I wasn't running a firewall, or malware protection OR any anti-virus software.

I have heard that a program associated with WoW addons called 'Curse Gaming Client' has had some issues with security and may have been a gateway for certain people to infect others. I was using this client, at the time when my account was compromised.

As a side-note, I was not using out-of-the-ordinary addons for WoW that may have directly caused this compromise (based on my best judgment).

---

I have deleted all of the files in the two 'temp' directories, but there wasn't much 'old' stuff in there as I recently used that tool to clear my temp files.

---


Let me know if you require any additional information to make your diagnosis/assessment of my computer's current status (is it infected??).

-Tyler

 

Thank you for your assistance - it is much appreciated it.

To ensure all of my bases are covered in the future, will an anti-virus program, firewall, SAS and Malwarebytes be a suitable collection of programs to use, or are there other things I should be doing?