Security

Ask something
Discussion Locked

Key-Logger Program that found CIM.$EC

0 helpful
3 replies

by maddiuex 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi Guys. Long one here OS is WIN2K Pro
Have a question, Ran the program called Key-Logger on my machine, and it found c:\winnt\system32\wmeb\repository\cim.$Ec ( CIM.REC ) and it deleted the files, I cannot get the file back, The backup does not have it on it, nor can I undelete the file with Finaldata, I then ran SpyCop on my machine and it found nothing. After searching the web I found that Pest Patrol stated the file to be one of SPECTOR's. I contacted Spector, and gave them the sitution and they state that this is not their file. I found another MS Article that states that it is part of a SQl/Windows messaging file. The file was created on 2/15/03. But I am unable to retreive it. I have ran McAfee, Norton, and Trend on my machine with nothing found, and Ad Aware and Spybot. Key-looger states it is a Key stroke catcher file and stands behind it's product. I have very sensitive material on my machine. And the machine does have to be on the internet for the material. I have a Sonic Firewall.. Any Ideas to what I would be looking at. And a program I can run to retreive this file. If not, I have to change all passwords ( Already have on my machine ) but would have to on 1200 machines also.
if anyone has ran into this problem,please respond, I need a solution ASAP....Thanks

Please dont reply with, take the machine off the internet, nor get better firewalls, hubs..etc.

3 replies

by joseph moore

Hmmm, is the file called CIM.REC or CIM.$EC??
'Cause I just looked at my Win2KPro machine, and I have CIM.REC in the C:\WINNT\system32\wbem\Repository directory.
WBEM is the Windows Management Interface (WMI) that does things I am not totally certain of. Here is a definition from Microsoft:
"Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management (WBEM), which is an industry initiative to develop a standard technology for accessing management information in an enterprise environment. WMI uses the Common Information Model (CIM) industry standard to represent systems, applications, networks, devices, and other managed components in an enterprise environment."

Ok, whatever!

Now, asto recover the file, I would try getting a copy of Norton Systemworks. Install it, and then let it build its list of recoverable files. It does that on install, lists all of the files that have been deleted but can still be recovered.

But, it does sound like you already tried this using Finaldata, which I have not used but it looks like a good product.

So, it is time to repair the install, apparently. If this is a Win2K or XP machine, you can boot to the Windows cd, and select to do a Repair.

I would suggest that. The SAM database info will be preserved, but system files will be replaced. YOu will have to re-apply all service packs/patches afterwards, but that is a small price to pay. I have used the Repair myself, and it can "sometimes" fix things.

But I don't think the file is virii/trojan. I could not find any virus results using that file name.

hope this helps

by maddiuex

Had all those areas covered already, Was needing to know the information of the file, not repairing.. Thanks though

This discussion is closed to new replies.