Hello Everyone.
I'm new here. I hope I'm in the right spot. Sorry if I posted in the wrong forum.
I'm having a few issues with my computer. First I need to find out how I can search my computer to see if there's a keylogger on it. I know webwatcher and spector soft are stealth and from what I hear supposedly can't be found by securtiy programs. Not sure how true that is, through. So, that's one problem. The next problem is that I have spybot search and destroy and when I ran that it picked up this "windows32PornPopUp." I deleted it the other day. Hoping that works. But now when I sign on to my computer it looks like some old MS DOS (or whatever) screens pop up and that never happened before. The screens say something like windows/command or windows/cmd - something. And another pop up box shows up after that from spybot asking to allow or deny a change to a registry file and the filename shows at spybotdeleting32.
Someone I was talking to on another forum told me to check my task manager to see if there's a keylogger running there, but when I do it just lists out a lot of processes that I have no clue what is running. And now my computer is running super slow.
Any help is greatly appreciated.
Thank you for you time in reading this post.
My name is Satchfan and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
• Please do not install/uninstall any programs unless asked to.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed! Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.
I will reply with instructions as soon as possible.
Double click DDS icon to run the tool (may take up to 3 minutes to run)
When done, DDS.txt will open.
After a few moments, attach.txt will open in a second window.
Save both reports to your desktop.
Post the contents of the DDS.txt and Attach.txt reports in your next reply
Download the GMER Rootkit Scanner
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO.
[external image: Posted Image] Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
IAT/EAT
Drives/Partition other than Systemdrive (typically C:\)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done, click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Hello NotTechSavvy
It has been several days since I sent my last post with instructions to help with your computer problem..
Please let me know if you are having problems with the instructions and need help.
Thanks
Satchfan
Please disable this program and leave it disabled until we are done.
Spybot's TeaTimer
Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
On the left hand side, click on Tools, then click on the Resident Icon in the list.
Uncheck the Resident TeaTimer (Protection of overall system settings) active box.
Click on the System Startup icon in the List
Uncheck the "TeaTimer" box and click OK at any prompts.
If Teatimer gives you a warning that changes were made, click Allow Change when prompted.
Exit Spybot S&D.
(When we are finished, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup).
Thanks for the logs but I am still waiting for the result of the Gmer scan. I’d also like to see what this is:
c:\program files\042820106484509.bat
Open Windows Explorer,(Windows key+E or right-click on the Start menu and choose Explore).
When you are in Windows Explorer, in the left window click on C:, then Program Files. In the right window, right-click on 042820106484509.bat, left-click on Open with… then choose Notepad.
Please copy and paste the contents into the next post along with the result of the Gmer scan.
Ok, I took care of the tea timer thing you mentioned. And I'm running the Gmer scan.
with regards to this file 042820106484509.bat I only had an option to open it it, not open with. So when I opened the file it went to c:\windows\system32\.cmd.exe. Now it's scrolling throgh and it's all MSN Games. It looks like an MS DOS screen, black with gray type.
I don’t see any signs of infection in your logs but we need to get to the bottom of the pop-up.
I’d also like you to try finding the contents of the 042820106484509.bat file by opening it in Notepad:
click on Start, Programs, Accessories, Notepad
click on File, Open
Click on c:\, Program files, 042820106484509.bat then OK
Copy and paste the contents in the next post.
Clear all your temporary files
DownloadATF Cleaner
• Double-click ATF-Cleaner.exe (on your desktop) to run the program.
• Under Main choose: Select All
• Click the Empty Selected button. If you use Firefox browser
• Click Firefox at the top and choose: Select All
• Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
• Click Opera at the top and choose: Select All
• Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu
Empty your Spybot Recovery (quarantine) folder
Open Spybot and click on the Recovery button.
The items that Spybot has quarantined will be listed
Place a check mark in the box next to each item listed and that click on Purge Selected Items.
Empty your recycle bin.
Download Malwarebytes-Anti-Malware
Click here
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.
To include in next post:
Contents of 042820106484509.bat
Mbam.txt
Please let me know how your computer is and if there are any current problems
Satchfan
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
