cisvc.exe keylogger [Solved]

Hi there, How do I know that the cisvc.exe that is just recently causing my CPU to use 100% of it's memory is or isn't a hack/virus? I tried to find the indexing service from a post I found about this before. But I sadly couldn't find it. I went through control panel and found something similar and disabled it, but it still runs and uses 100% of my CPU. When I try to find the file it says it can't be located. In Norton I went to Security History to Performance Alert and found the path of the file. It is - C:\users\MyName\appdata\local\temp\wtfbnnrik\cisvc.exe I'm worried it could be a keylogger and my passwords are at risk. Thank you for any help in advance! Jeff

Hi Jeff,

The fact that cisvc.exe is running from the appdata folder raises red flags. Let's run some scans.

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments,  attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scrolling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

===================================================

Please download aswMBR.exe and save it to your desktop. 

Double click aswMBR.exe to start the tool. (Vista/Windows 7 users - right click to run as administrator)

Click Scan

• Upon completion of the scan, click Save log and save it to your desktop, and post that log in your next reply for review.
• Note - do NOT attempt any Fix yet.
• You will also notice another file created on the desktop named MBR.dat.
• Right click that file and select Send To>Compressed (zipped) file.
• Attach that zipped file in your next reply as well.

Hey NoodleTech, Thanks for helping me out. I have the logs ready, but I posted on another forum and apparently I have an illegal program on my computer and they can't help me because of that. I'm worried that the same will happen here. So I'm trying to find and delete this program before I post any logs.

Hi Jeff, I can't help you if you're being helped on another forum as we can give conflicting instructions. So at this point you'll need to choose whether you would like to be helped on this forum or the other forum. Let me know.

Jeff, Do you still need help?

Hey NoodleTech. I figured it out and fixed the problem. Thanks for all your help.

You are very welcome! Happy new year!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.