Vice City Trainer MAY be keylogger!!! READ if you have it!

radarlove8 · #1 09-07-2003, 18:47

I *think* one of the GTA vice city trainers MAY contain a key logger. The reason for this is because after running the DARKNeZZ.exe which is the trainer I found a file in the system32 file. Search and destroy spybot remover noticed the file which was called H@tKeysH@@k.DLL. After some research on that .dll file it appears to be the hotkeyshook key logger Trojan. I had S&D to remove the file. To test my idea of it being placed there by the trainer I rebooted and scanned my system which the file was not detected. I then loaded the trainer and turned it off at which time I scanned again with S&D and the file was BACK! It should be noted that nortons antivirus did NOT pick this up. I submitted the trainer to them to be checked and have not heard back other than an auto message telling me they got the file. Most of the time if a suspected file is clean you know something within hours but this has been almost 2 days now without word from them. I am not using this file until I find out for sure. There could be nothing to this but it was enough for me until I know for sure. I just thought you guys should have the information and decide for yourself as I am sure a lot of the people reading this may know more than I about programming.

TippeX · #2 09-07-2003, 19:41

trainer was downloaded from gcw?

radarlove8 · #3 09-07-2003, 19:52

yes I got it from GCW.

GTA: Vice City v1.1 +6 TRAINER
the file name is drz-vc6t.rar
it was submitted by DARKNeZZ

http://dl.gamecopyworld.com/dl.cgi?drz-vc6t!rar

Black Diamond · #4 09-07-2003, 20:30

Scanned with latest McAfee and latest Trojan Remover - found nothing.

radarlove8 · #5 09-07-2003, 21:23

Nortons did not find anything either but it is only as good as the definition and if this file has never been submitted then they will have no way to identify it as a virus. Search and Destroy Spybot listed that dll file as a keylogger. The dll file is placed by the DARKNeZZ.exe...so that is why I am wondering. The search and destroy program is good at finding spy related software. I am not saying 100% that this is a key logger but it looks like it from what I have been reading. I am not using it....anyone that does that is up to them.

Here is a link to S&D spybot remover..it too has definitions that you update just like anti-virus software. Make sure you keep it up to date.

http://security.kolla.de

Eagle · #6 10-07-2003, 01:12

the file H@tKeysH@@k.DLL *CAN* be used for key-logging. but its a part of that trainer to access the hotkeys in the game!

ash2dust2 · #7 10-07-2003, 11:43

One of the BF1942 trainers also used H@tKeysH@@k.DLL, at the time I googled the file name, most people seemed to think that it was normal. Its function is to capture keystrokes which you need to enable and disable the trainer in the game. But it could also be used maliciously if the author decided too.

cdkiller · #8 10-07-2003, 14:40

eagle is right...

no keylogger inside.
why the hell should a dox group include a keylogger ???

Quote:

I am sure a lot of the people reading this may know more than I about programming.

yep, and i say it´s no keylogger

Joe Forster/STA · #9 12-07-2003, 06:55

Uhm, guys, isn't this DLL part of some audio/video driver?! I also have it on my Windows '98 machine but I don't remember having ever tried a trainer for the first GTA3 or Vice City...

Joe

ash2dust2 · #10 12-07-2003, 08:28

Not from any drivers I have installed from Nvidia, Creative or Turtle Beach.
Its appears to be a common file used in more than one trainer.

radarlove8 · #11 12-07-2003, 12:56

I also posted this one dslreports gaming page. I got this from one of the readers.... Oh BTW it does not have anything do with with audio/video drivers and IS NOT part of a system file. It would have to be put there by the trainer. Now as far as part of a common file for trainers......that maybe the case, but I would want to know for sure that is not what it is there for.

Here is that thread if you would like to read it
http://www.dslreports.com/forum/rema...ames~mode=flat

"There was a thread on the forums over at gta-vice.com about this a month or two ago. The author of the trainer you're talking about and LithJoe (who is involved with gta-vice.com and has his own trainer) were going at it about whether or this file was spyware. The author of the trainer you're talking about refused to ever address what that file was doing there, and eventually started resorting to threats. Needless to say I was given the impression that the trainer you're talking about does in fact include spyware.
I'd recommend using LithJoe's trainer instead:
http://trainer.gta-vice.com/ "