Found A TROJAN

[Rebel=UK=]

Found a trojan earlier , i knew i had something was wrong as when i started up windows it would hang on the "Welcome" screen , so i started up in safe mode and ran the cleaner it found....

Trojan Small in the C:\ut2004\cache\cache.ini & 2 more of the same in other files im guessing its stole my Unreal Tournamnet 2004 CD key.....please tell me im wrong

this is what the Cleaner Database has to say on it:

Trojan Information

Name: Small

Created: July 09th, 2002

Modified: July 07th, 2004

Aliases: None

Type: Dropper

This is a small trojan that contains another trojan. It's purpose is to hide the real trojan.

Information: None

[nellie2]

did the Cleaner get it?

[Rebel=UK=]

aye it cleaned and deleted them, i want to know if it stole the cd key from ut2004.

[nellie2]

I really don't know I'm afraid :(

[Rebel=UK=]

Ok no prob nellie but can someone tell me if the CD key is stored in the Cache.ini file? if it has im going to have to splash out another £30 on a new copy

[nellie2]

I'm not an expert on this but I think that is where your downloaded maps and things go, and it is cleaned out after 30 days..... I think!

[Bluecow]

Ok no prob nellie but can someone tell me if the CD key is stored in the Cache.ini file? if it has im going to have to splash out another £30 on a new copy

The key is in your registry, but it still may have gone :( The only way to know is to try and join a server.

How do you secure your key:

WARNING: This requires some technical knowledge, and confidence in using the Windows Registry, and altering permissions that could lead to locking yourself out of your computer. (Worst Case Scenario) Do this at your own risk.

-----------------------

- First, create a new account on your computer, its not hard to do, and make sure it is part of the Administrators group. (you can hide this account from the logon screen too, but i wont go into that). Give the user a name like "UnrealUser".

- Next, open REGEDIT and goto the key that contains your cd-key (HKEY_LOCAL_MACHINE\SOFTWARE\Unreal Technology\Installed Apps\UT2003).

- Right click the key (thats the folder), and select "Permissions...", click "Advanced" to get a new screen.

- Make sure that BOTH checkboxes on the bottom of this new screen are OFF. (You might be asked for confirmation, just press Yes)

- Now, remove everything that you can see in that list until it is completely empty. Then click add and add "UnrealUser", and give the user FULL CONTROL "Allow" on the next screen, then press OK.

- UnrealUser should be the only entry in the list. And the bottom two checkboxes off. Press OK. If you are asked for confirmation, press Yes. Press OK again (also accepting any confirmation).

- Watch as your UT cd-key completely dissappears from Regedit. Dont worry, its not gone, but completely hidden to all programs. You can try to add a registry key in that folder if you wish, it wont let you.

(Now is a good time to point out you can reverse this by selecting permissions here again, and adding permissions for the Users group, and the Administrators group. You will be allowed to alter the permissions.)

If you try to play UT now, it will get so far, then crash saying that your CD-key is invalid. This is correct, because as far as it knows, it doesnt exist in the registry.

If you now log on as UnrealUser, and then run UT, it will run perfectly, including online.  You do not need to logoff first if you use windows XP, just use the Switch User mode, that way you can still come back to your programs without quitting them.

You might lose a few user based OS settings, like your mouse sensitivity, but i have tried this myself completely and it works fine. Have fun. 

There are other key securing utilitys out there have a look here.