Phanotm Keystroke

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by dudders, Aug 29, 2009.

  1. dudders

    dudders Private E-2

    Hello i play a lot of pc fighting games, so of course i use a joypad and adapter.(just to verify this is not a hardware problem.. I think. If it is i will move this to the appropriate section)

    One day i was trying to set up a second joypad to the program (this is not a specific program problem) and before i could map the inputs on the controller, some weird input from the keyboard took the place of the input.

    The keystroke differs from program to program but the fact is that every program in which i try to map inputs (not just controllers, any game where i try to change the control scheme) this weird keystroke pops up before i can map a new key.

    Thes are the keystrokes i have observed:
    0xFF
    0x8D
    0x6F
    other programs just read the input as ?.

    edit: forgot to mention that Rootrepeal ran into these errors:
    FOPS-DeviceIoControlError!0xc0000024 Extended Info (ox000000ec)
    DeviceIoControlError! Error Code = 0x1e7
    DeviceIoControlError! Error Code = 0x0
    Could not initailize driver! Please contact the author!
     

    Attached Files:

    Last edited: Aug 29, 2009
  2. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi and welcome. I can indeed review your logs so we can rule out malware, and if so, once we have, we can refer you to the appropriate software/hardware forum.

    FYI though:

    The version of MGTools.exe that you have run is very outdated. Please follow the below instructions:

    Go to this link Using MGTools and download the new version of MGtools.exe using the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.

    Now run the new MGTools.exe and attach the ---> C:\mglogs.zip that it generates. into your next reply here.

    Thanks
    kes13!
     
  3. dudders

    dudders Private E-2

    Thank you for the reply.
    here is the updated mglogs.zip
     

    Attached Files:

  4. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there Dudders!

    a) Could you let me know about the following please?

    This:
    • ƒAƒJƒcƒL“dŒõí‹L

    Appears in your uninstall list in your logs. Can you tell me also if it shows up in your add/remove programs listing? If it does, do you know what it relates to?

    b) What about this:

    c:\program files\“Œ•ûä–²‘z <--- Again, could you tell me if you know what it relates to?

    c) Why are you using this machine without being protected by any anti-virus?

    d) Also FYI:

    You should tidy this desktop: tidy this desktop:
    • C:\Users\Xavier\Desktop

    (A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files there.)

    1. Please go to Add and Remove programs and uninstall the following software:

    • Java(TM) SE Runtime Environment 6

    2. If you do not use Windows Messenger Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    3. Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    After clicking Fix exit HJT.

    4. Now we need to use ComboFix
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    • If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    • Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
    Code:
    KILLALL::
    
    DirLook::
    c:\program files\“Œ•ûä–²‘z
    C:\Program Files\ƒAƒJƒcƒL“dŒõí‹L
    
    Registry::
    [-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
    
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe

      [​IMG]

    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    5. Now REBOOT your machine and install the most current and up to date version of Java available here at the below link:

    Java Runtime 6

    6. Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Combofix.

    7. Let us know of any problems you may have encountered with the above instructions and also let me know how things are running now!
     
  5. dudders

    dudders Private E-2

    I am starting to think that this is a hardware problem.....

    the keystroke still pops up when i try to map inputs.

    but something strange did happen, while i was waiting for a reply my isp sent me an email saying that there was an infected machine in my network.... so i was infected with something.

    fortunately after following your steps everything went back to normal. except for the keystroke.

    here are the logs


    and i thought that Comodo doubled as a antivirus program....

    any suggestions on a free anit virus program to use? (us college students are BROKE:cry)
     

    Attached Files:

  6. Kestrel13!

    Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

    Hi there Dudders :)

    You neglected to answer a few of my questions:

    a) Could you let me know about the following please?

    This:

    • ƒAƒJƒcƒL“dŒõí‹L


    Appears in your uninstall list in your logs. Can you tell me also if it shows up in your add/remove programs listing? If it does, do you know what it relates to?

    b) What about this:

    c:\program files\“Œ•ûä–²‘z <--- Again, could you tell me if you know what it relates to?

    Thanks.

    Also... to check about the anti-virus, could you please double click on it's tray icon and let me know for sure that it does indeed say anti-virus?

    You didn't install new Java so that remains to be done also.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds