How to find a keylogger?

Hello NotTechSavvy It has been several days since I sent my last post with instructions to help with your computer problem.. Please let me know if you are having problems and still require help. Thanks Satchfan

I'm so sorry. I didn't forget, I don't get on the computer on the weekends and my kids are off from school this week. I'm going to go look at your last post now. Thanks.

Ok, here is the .bat file. It's just a silly MSN Game :tryDelete IF EXIST "C:\Program Files\MSN Games\Big Money" GOTO WaitAndTryAgain ping -n 2 localhost>NUL for /f %%a in ('dir /b "C:\Program Files\MSN Games"') do ( GOTO End ) :EmptyLabel echo "EMPTY" rd /s /q "C:\Program Files\MSN Games" IF EXIST "C:\Program Files\MSN Games" GOTO WaitAndTryAgain GOTO End :WaitAndTryAgain ping -n 2 localhost>NUL GOTO tryDelete :End Del /F /Q "C:\Program Files\042820106484509.bat" I'm running the malware scan now and will post once that is complete. I have also cleared the temporary files and cleared spy bot search and destroy

Here is the mbam.txt file Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 5854 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 2/23/2011 3:34:30 PM mbam-log-2011-02-23 (15-34-30).txt Scan type: Quick scan Objects scanned: 163685 Time elapsed: 14 minute(s), 1 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 6 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Thanks for the logs NotTechSavvy

It looks as if your computer is clean but we’ll run a final scan just to be sure.


Run AVPTool by Kaspersky

Download AVPTool from Here to your desktop

Run the programme you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

• On the first tab select all elements down to Computer and then select start scan
• Once it has finished select report and post that.
  
  [external image: Posted Image]

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan

• Select the Manual Disinfection tab
• Press the Gather System Information button
• Once done Open the last report saved folder then attach the zip file to your next post zip
• The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip
  
  [external image: Posted Image]

Can you also let me know if there are any remaining problems.

Satchfan

Do I have to use Kaspersky? I have Avira, even though the trial expired I still runs scans. I just can't get file updates.

Yes, please use Kaspersky

Hello NotTechSavvy It has been several days since I asked you to frun the AVP scan. Please let me know if you are having problems and still need help. Thanks Satchfan

I've been running the scan all morning and it's now only at 63% completetion. I have a warning box now that says: Kaspersky Virus Removing Tool has detected legal software that can be used by ciminals for damaging your computer or personal data. Object: C:\System Volume Inforamtions\_rest….|A0059937.DLL Detected" not-a-virus:AdWare.Win32.FunWeb.ci Then it's asking to either Delete (recommended), Skip - Do not perform any action, and Add to exclusions - add to exclusions list.

The scan is still running. It's at 74% completion now. Just had another thought. Will all this work that is being done also pick up any "sniffers" on the router? I'm still nervous that a program like webwatcher or spectorsoft. Those programs are supposed to be stealth and programs like Norton are not supposed to pick them up (I have a legit reason for being this paranoid). Thanks for all your help. NTS

Hi NotTechSavvy Choose the option to "Delete it (as recommended)" if prompted Don't worry about anything else for the moment, just send the results. Satchfan

It's only prompted me to delete a something, once. The scan is still running and it's at 92% completion. I let it run over night as well. And today, my computer is slower then even. It literally takes minutes to pull up a new screen. Also, there's a new icon on my task tray. It looks like an ampesand, however the "symbol" is not there. It's completely black. If I hover my mouse over it, it doesn't give me a description of what it is and I can't even click on it. I've never seen that before.

Ok, it finally finished. Here's the log. I had to restart my computer because it running extremely slow. I'm running the analysis scan now. Hopefully it doesn't slow down my computer.

NotTechSavvy

Things are looking good with the basic scan but can you please attach the avptool_sysinfo file

Thanks

Satchfan

I was just logged into a hotmail account and then a window AVG Security popped up and wanted to do a scan. This is what it shows. What is all of this? Adware.Win32.Winad Trojan Horse IRC/Backdoor.SdBot4.FRV AdvWare.Hotbar Trojan.Qoologic - Key Logger W32.Benjamin.Worm W32.Mypics.Worm.36352 W32.Nimda.J@mm Win32/Hoax.Renos.HX Trojan virtumonde Adware.Win32.Look2me.ab Trojan Horse IRC/Backdoor.SdBot4.FRV Trojan-Downloader.Win32.Tibs.tc ieakui.dlliesetup.dllforcedos.exewuauclt.exedrmclien.dllhh.exeFSISU.logdsdmo.dll ezsidmv.datstrmdll.dllapphelp.dllwinhlp32.exe I clicked remove then another box popped up AVG Windows Internet Explorer. It shows System Folders (shared and my documents) with "9 threats found" in shared and "3 threats found" in my documents. They are red bold and flashing back and forth. Then under hard drive it shows the c drive and 12 threats found, same red bold and flashing. Then below that it shows security, then windows security and in red bold (not flashing) security affected by threat. Now I'm getting a pop up window that says Do you want to run or save this file. Name setup.exe Type: Application From: c7f0d.dallersecure2.com I clicked cancel and it just came back.