Need help with "webwatcher" type program

[oneZeros]

Hello, I am new to the board and this is my first post.

Ive been lurking through the board and Im pretty sure you guys could help me with my problem.

My ex-girlfriend has installed a program on my computer that logs my keystrokes and passwords, and gives snapshots of my screen.

I have checked out and loaded the spyware removal guid however im not sure if this is the direction I need to go.

Any help on where to start would be greatly appriciated.

Im using MS windows 98.

So far I have looked though MSCONFIG, but im just not sure what Im looking at.

Heres another hint. As far me knowing she has something on my computer (she can get my email password no matter how many times I change it), I can press controle-alt-caps and a window pops up asking for a password.

Needless to say im not using my computer for e-mail usage and Ive changed the password using another computer and I know she hasnt accessed it again.

Thanks for any help, Josh.

 

[Trotter]

Sounds like a sticky situation. Personally, I would ditch her and take whatever measures I need.

As for what is running on your computer, open up Task Manager and look at the processes running. Google each one that you do not know to find out what it is. You can do the same with MSCONFIG.

You could also try |MG| AnVir Task Manager 5.2.0 to see your processes. It is more complete than the Windows Task Manager.

Once you find it, use |MG| Revo Uninstaller 1.71 to uninstall it. Revo will scour all the way through the registry to get rid of it for you.

 

[oneZeros]

Here are some processes I have found that I think are causing problems.

I looked up each process on PC Review - Computer News and Reviews
(example) IEXPLORE.EXE

Alcxmnt.exe
CCAPP.exe
spoolsu.exe
svchost.exe came up as a potential keylogger
csrss.exe " " " "


NOPDB.exe access denied when I tried to end process.
smss.exe

IEXPLORER.EXE

alg.exe


I was trying to look at svchost.exe using the run program/ tasklist.exe

The black screen will just "blink" then disappear.

one of the processes that I entered on the site cam back as "MDSA sentinel X" however I forgot to write down which one it was.

I know I have no clue what Im talking about, but I can pick things up fast if anyone is willing to help.

Thanks, Josh.

 

[SirCyber]

Trotter, would a hijackthis log help him out? *lol, this is precisely the thing that I threatened one of my ex's who I suspected of cheating on me.* dude, I'd confront her then dump her. and svchost.exe is a trusted program

 

[KSoD]

Trotter, would a hijackthis log help him out? *lol, this is precisely the thing that I threatened one of my ex's who I suspected of cheating on me.* dude, I'd confront her then dump her. and svchost.exe is a trusted program

I dont think HiJack This works on Windows 98. Nor fors much of any apps to remove the software.

You best bet. format and reinstall 98.

Also i would not put the blame so fast on your ex. Windows 98 has not had a single patch put out for it in over a year. That means every flaw that has been found to affect all version of Windows for the last year is still active on your PC. Including the DNS flaw which can allow someone to take over your PC. So being as it may you could just flat out be hacked.

Cheers,
Mak

 

[SirCyber]

good call mak. yeah, a reinstall would be one of your best bets

 

[oneZeros]

she is my x. We are no longer together b/c of this crap.
sociopath. nuf said

Fatal attraction style

Its also a class A misdemeanor.

I am absolutly sure its her. She has told me herself.

What she wont fess up to is how she got my password every time I changed it, no matter how ridiculous I made it. She just recently deleted e-mails that a different female had sent me and then confronted me about it.... ITs her.

I just dont see any other way she could do it.

She tells me she just sits there and will "figure it out" each time. No way

I really need to be able to show on paper what is on my computer before Im ready to deleting anything or re-format.

How can I get tasklist.exe to "run"?

IS there really no other option than to re-format?

No way to find what program it is or what website my information is being relayed to?

I appreciate your help fellas. Josh.

 

[Kharn]

see if you can get hijack this running on your 98 rig you might be able to get some useful info, also contact the vendor of the software to see if there is any way to uninstaller they should have some way of getting rid of it.

I would also consider just formatting the drive an installing the os fresh again an then setting a new password for the email, an if its a isp email address i would contact them.

 

[oneZeros]

ok, I dont have windows 98, I have windows 2000.

I will try the hijack log and get back with that.

SO what possibly could be asking for a password when I hit Ctrl-alt-caps ?

 

[oneZeros]

Well its one thing after the next.

I tried loading the programs in the guide but I get a message saying MSword cannot find the server or proxy server.

ANyideas? Ill try again tomorrow. Maybe I need to adjust some settings?>