[Resolved] I RAN KL-Detector looking for key loggers
29 min read
1) If you have already posted this log at another forum, you need to post here that you have done so and this topic will be closed.
Multiple posting not only ties up valuable resources, but could also result is some unpleasant side-effects for your system if you follow two sets of instructions at the same time.
If, during research, an identical log is identified at another forum, this thread will be closed.
2) If you don't post a meaningful reply to any of my posts within five days, this thread will be closed. Due to limited free time, I can only have so many open threads at any one time and if yours isn't active, somebody else's will be.
If, by omission, the thread hasn't be closed after five days and you post, it will just serve as a reminder to me to close it.
Please note that "I just dropped in to say Hi!" isn't a meaningful reply!
3) Malware removal is a tricky business, and malware writers don't tend to worry about the damage their creations do, so it is advisable to back-up all important files BEFORE we start. Although most cases have a successful conclusion, on occasion things don't go according to plan and it is better to be prepared for the worst.
4) Back-ups can get lost or damaged, so make two if the files are that important to you!
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The program you used is designed to monitor your hard drive for the record of your keystrokes that a keylogger would make. Unfortunately it will pick up other changes on your PC too, so the log cannot be taken as gospel for keylogger detection.
Ideally you should take the computer offline, run the prgram, and type into Notepad for a few minutes and then see what the program detects to cut down on the false positive detections that may occur.
Is there any reason for you to suspect a keylogger, or was it simply a looksee that you were doing?
Too many logs and not enough hours i'm afraid. We deal with what we can and the rest unfortunately get passed by.Did not think anyone had seen this.
Nobody says Hi! any more -I don’t think I have said, "I just dropped in to say Hi!"
I suspect that whatever is causing this is unlikely to be malicious, but I cannot guarantee that - it just seems a little too, for want of a better word, "sad" to be malicious.
We'll start with a scan to look for malware and then i'll see if I can come up with a possible cause for your issue.
Download Malwarebytes' Anti-Malware from here and save it to your Desktop.
- Double-click mbam-setup.exe and follow the prompts to install the program.
- Ensure a checkmark is placed next to both Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware and then click Finish.
- If an update is found, it will download and install the latest version - you'll need to clear it with your firewall.
- Once the program has loaded, select Perform full scan and then Scan.
- When the scan has finished, click OK and then Show Results to view the results - no surprise there!
- If MBAM finds anything, check the box(es) and click Remove Selected.
- When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Also, run HJT and click on Open the Misc Tools section.
- Click Open Uninstall Manager…
- Click Save list… and save it to your Desktop.
- Copy and paste the file uninstall_list.txt into your next reply.
My computer is running good other than “IT”(whatever “IT” is) copying to my desktop and the Documents and Settings.
Take your time, as this has been going on for a while now, and thank you very much.
I already had Malwarebytes' Anti-Malware installed.
Here are the results:
Malwarebytes' Anti-Malware 1.34
Database version: 1826
Windows 5.1.2600 Service Pack 3
3/7/2009 11:06:50 PM
mbam-log-2009-03-07 (23-06-50).txt
Scan type: Full Scan (A:\|C:\|D:\|)
Objects scanned: 179348
Time elapsed: 45 minute(s), 3 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
I already had Trend Micro HijackThis 2.0.2. Here are the results. (I did not see a Miscellaneous Tools Section).
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:16:57 PM, on 3/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\NCH Software\FileFort\filefort.exe
C:\Program Files\Iminent\IMBooster\imbooster.exe
C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comodo\BackUp\CmdBkSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\DAP\DAP.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SBCONVERT - {A1056498-D09A-41E4-864B-505EDD640D9E} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll
O2 - BHO: Iminent.LinkToContent - {A6E9BAAF-53CD-4575-967B-2AF710A7D21F} - C:\Program Files\Iminent\IMBooster\Iminent.LinkToContent.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O2 - BHO: GrabberObj Class - {FF7C3CF0-4B15-11D1-ABED-709549C10000} - C:\PROGRA~1\SpeedBit Video Downloader\Toolbar\grabber.dll
O3 - Toolbar: SpeedBit Video Downloader - {0329E7D6-6F54-462D-93F6-F5C3118BADF2} - C:\Program Files\SpeedBit Video Downloader\Toolbar\SpeedBitVideoDownloader.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Verizon_McciTrayApp] "C:\Program Files\Verizon\McciTrayApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [FileFort] "C:\Program Files\NCH Software\FileFort\filefort.exe" -logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [IMBooster] C:\Program Files\Iminent\IMBooster\imbooster.exe /warmup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Alwil Software\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DownloadAccelerator] "C:\Program Files\DAP\DAP.EXE" /STARTUP
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ComodoBackupService - COMODO - C:\Program Files\Comodo\BackUp\CmdBkSvc.exe
O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
–
End of file - 8437 bytes
Too many logs and not enough hours i'm afraid. We deal with what we can and the rest unfortunately get passed by.Did not think anyone had seen this.
Nobody says Hi! any more -I don’t think I have said, "I just dropped in to say Hi!"
![]()
I suspect that whatever is causing this is unlikely to be malicious, but I cannot guarantee that - it just seems a little too, for want of a better word, "sad" to be malicious.
We'll start with a scan to look for malware and then i'll see if I can come up with a possible cause for your issue.
Download Malwarebytes' Anti-Malware from here and save it to your Desktop.
Let me have the MBAM log, a fresh HJT log (run in Normal Mode) AND a description of how your PC is behaving.
- Double-click mbam-setup.exe and follow the prompts to install the program.
- Ensure a checkmark is placed next to both Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware and then click Finish.
- If an update is found, it will download and install the latest version - you'll need to clear it with your firewall.
- Once the program has loaded, select Perform full scan and then Scan.
- When the scan has finished, click OK and then Show Results to view the results - no surprise there!
- If MBAM finds anything, check the box(es) and click Remove Selected.
- When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Also, run HJT and click on Open the Misc Tools section.
- Click Open Uninstall Manager…
- Click Save list… and save it to your Desktop.
- Copy and paste the file uninstall_list.txt into your next reply.
If the button isn't visible when you open HJT, there should be a button at the button marked Main Menu - click that and you should see the Open the Misc Tools section button.I did not see a Miscellaneous Tools Section
32 Bit HP CIO Components Installer
7-Zip 4.65
Ad-Aware
Ad-Aware
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9
Advanced SystemCare 3
AM-DeadLink 3.3
Apple Mobile Device Support
Apple Software Update
ArtStudio GOATD 1.1.2
Audacity 1.2.6
AusLogics Disk Defrag
avast! Antivirus
AVS Audio Editor version 4.2
AVS4YOU Software Navigator 1.3
Backup4all Lite 4
Belarc Advisor 7.2
Calculator Powertoy for Windows XP
CCleaner (remove only)
Comodo BackUp
DeepBurner v1.9.0.228
Doc Scrubber v1.1
Download Accelerator Plus (DAP)
DriverMax 4
EasyCleaner
Everything 1.1.4.301
FastStone Photo Resizer 2.8
File Fort
filehippo.com Update Checker
getPlus® for Adobe
Glary Utilities 2.10.0.622
Google Toolbar for Internet Explorer
HijackThis 2.0.2
HP Imaging Device Functions 8.0
HP OCR Software 8.0
HP Officejet J3600 Series
HP Solution Center 8.0
HP Update
IMBooster
IMBooster
Intel® Graphics Media Accelerator Driver
iTunes
Java™ 6 Update 12
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Office 97 Sounds (Remove only)
Microsoft Office 97, Professional Edition
Microsoft Office PowerPoint Viewer 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
MSXML 4.0 SP2 (KB954430)
MWSnap 3
PC Pitstop Optimize2 2.0
QuickTime
Recuva (remove only)
Revo Uninstaller 1.80
Secunia PSI
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Smart Defrag 1.11
SoundMAX
Spybot - Search & Destroy
Titan Backup
Unlocker 1.8.7
VC 9.0 Runtime
Verizon Help and Support Tool
Verizon Online
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
W Photo Studio
Windows Defender
Windows Internet Explorer 7
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 11
WinPatrol 2008
Yahoo! Browser Services
Yahoo! Messenger
Yahoo! Toolbar
If the button isn't visible when you open HJT, there should be a button at the button marked Main Menu - click that and you should see the Open the Misc Tools section button.I did not see a Miscellaneous Tools Section
Are you saying that you had the problem before you reformatted and reinstalled?I do not know if this is why I still have the same problem after doing a clean install maybe about six weeks ago
Are you saying that you had the problem before you reformatted and reinstalled?I do not know if this is why I still have the same problem after doing a clean install maybe about six weeks ago
Unlikely, as you would have had to have installed it wrongly previously as well to have the same problem.Or maybe I installed Windows wrong.
It seems to me that one of the programs you installed and/or updated is responsible for the problem and it isn't going to be that easy to track down which one it is.
There are three options that I can think off. The first is to post the details of the problem here: Microsoft Windows™. Somebody may have experienced a similar problem.
The second is to reformat and reinstall again and install the programs one at a time and update them until you can identify what program was the last on onboard when the problem reoccurs.
The last is to live with it, which is the easiest if not the best.
Unlikely, as you would have had to have installed it wrongly previously as well to have the same problem.Or maybe I installed Windows wrong.
It seems to me that one of the programs you installed and/or updated is responsible for the problem and it isn't going to be that easy to track down which one it is.
There are three options that I can think off. The first is to post the details of the problem here: Microsoft Windows™. Somebody may have experienced a similar problem.
The second is to reformat and reinstall again and install the programs one at a time and update them until you can identify what program was the last on onboard when the problem reoccurs.
The last is to live with it, which is the easiest if not the best.
All right, thanks much. Will try the Microsoft Windows soon as I can. I appreciate your help.
![]()
Unlikely, as you would have had to have installed it wrongly previously as well to have the same problem.Or maybe I installed Windows wrong.
It seems to me that one of the programs you installed and/or updated is responsible for the problem and it isn't going to be that easy to track down which one it is.
There are three options that I can think off. The first is to post the details of the problem here: Microsoft Windows™. Somebody may have experienced a similar problem.
The second is to reformat and reinstall again and install the programs one at a time and update them until you can identify what program was the last on onboard when the problem reoccurs.
The last is to live with it, which is the easiest if not the best.
Right hand side, towards the top - NEWTOPIC.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI