H@TKEYH@@K.dll - Trojan?

[ShadowTiger]

Everyone, check in your C:\Windows\System32\ folder for the file "H@TKEYH@@K.dll" ... If you see it, you probably don't have to worry much. (Or at least as far as I know.) Take a look at This (http://www.fileforums.com/showthread.php?p=222547#post222547) thread. Apparently, this "Trojan" is used to allow the use of hotkeys between programs.

I think that if you used Mottzilla's ZC Console program, this "Trojan" will have found its way onto your PC to help with that particular trainer.

Mottzilla? Any input on this? Thoughts?

[SoStaci]

I don't have that .dll file.

[MottZilla]

Um, I have that file, and I don't have any problems. And examining it myself it seems to simply be a dll for hotkeys. How did you figure this was a trojan? FYI, the latest ZC console was just thrown together with trainer maker kit. Older versions I coded in ASM. Anyways, I highly doubt it is anything harmful, esspecially coming from such a widely used program. But if you find anything out about it that proves it is harmful let me know and I'll remove ZCConsole and rewrite it myself in asm.

[ShadowTiger]

Er, thanks Mottzilla. I found it from This (http://www.fileforums.com/showthread.php?p=222547#post222547), again. Other people seem to know about it, so...


...

They have trainer-making kits? O_O .. Cool! :kawaii:

[MottZilla]

Indeed, it was made to make designing trainers fast and easy. You could always write a better/smaller/faster/more efficant trainer by hand in C or ASM but it takes alot more effort ussually.

[Freedom]

here's some more info that Paul doo found.

TROJAN (http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_HOTKEYHOOK&VSect=T)

Yea, doesn't sound like something I'd want rewriting files on my computer.

[ShadowTiger]

Um, I have that file, and I don't have any problems. And examining it myself it seems to simply be a dll for hotkeys. How did you figure this was a trojan? FYI, the latest ZC console was just thrown together with trainer maker kit. Older versions I coded in ASM. Anyways, I highly doubt it is anything harmful, esspecially coming from such a widely used program. But if you find anything out about it that proves it is harmful let me know and I'll remove ZCConsole and rewrite it myself in asm.Hm. Some security nuts around here (Myself / father included) repeatedly find this "H@TKEYH@@K.DLL" program installing itself even after removing the afflicting files. Perhaps it really is time for a re-write, Mottzilla? :shrug: Such a thing would be greatly appreciated by the whole community, as your time and formidable skills kindly spent are of a tremendous value to us. :) Thank you very much, Mottzilla.

[Freedom]

BH4,
read that site I posted.
Basically it says your screwed, since it rewrites one of your files the only way to get rid of it now is to wipe your disc. unless you have a back-up of "SCANREGW.EXE" that you made just before you downloaded mottzilla's virus.


Note: The Microsoft Windows Operating System (Windows 98 or ME) has its own SCANREGW.EXE program that is responsible for checking and backing up the registry. This program executes on system startup.

The Trojan takes advantage of this function of the file by copying its own code and renaming its dropped file as SCANREGW.EXE so that its copy executes upon system startup. It has a compressed copy of a normal SCANREGW.EXE (Korean version).

The Trojan initially extracts the normal or clean SCANREGW.EXE and overwrites the extracted file to TEMP$01.EXE. It extracts its pure code and overwrites it to the TEMP#01.EXE file, loads the file to memory, and drops a DLL file, H@TKEYH@@K.DLL in the Windows System directory. Its behavior is visible in the System Information tool found in this path:
Start>Programs>Accessories>System Tools>System Information.

The Trojan calls the TEMP$01.EXE file, which contains the normal SCANREGW.EXE on system restart.



and


Note: The modified SCANREGW.EXE is non-recoverable. The copy that this Trojan carries is a Korean version of the normal or clean SCANREGW.EXE, which does not run on English versions of the Windows Operating System.

[MottZilla]

Do NOT call it MY virus. You asshole. Download or do research on Trainer Maker Kit, that is the software that was used. Again, I've NEVER had any problems with the software nor has anyone else. Don't post retarded shit about things you don't understand or accuse me of shit. Read the fucking topic. I already explained it was made with popular and freely available software. If you don't trust using it, then don't use it. BH4, I doubt there will be any rewrite, as again, I've seen nothing to suggest that there is any problem. Many spyware or virus scanners will falsely detect files simply by sharing the same file name as another file which is a virus or spyware. However AGAIN, it is very popular software and hasn't given anyone any such problems.

[Tom]

Yay so it's not just me who doesn't like the way Freedom acts to people. Well anyways I've had this in my system folder and haven't noticed anything wrong with my computer. I don't think it's a virus it hasnt been detected by norton antivirus or any spybot or adaware i have. Also loads of programs put dll files in system folders, games do it etc. they are just things to make games or programs work. I haven't seen anywhere apart from this thread where it has been described as a virus. I really don't think Mottzilla would be hiding a virus from everyone. He's much more well known than you Freedom and he's been around much longer than you. I think accusing him of creating a virus is a bit much especially when its not even detected as a virus by anything.

[Sephiroth]

Nope don't have it nor weant it. XD

[Freedom]

Tom,
You're an idiot.

Mottzilla,
You're right, poor choice of words, it's not YOUR trojan, you're just helping to spread it around.
Most people I know have removed your program from their computer, as for me, I never opened it to begin with.

[Tom]

Ummm Freedom, just because everyone hates you doesn't mean you can blame people for spreading viruses around.

[VEL]

Topic closed since people are starting to flame each other, and it will probably only get worse.....