Keys cannot type when pressed

Raphee · Feb 8, 2011

I think the problem started when I received an email notification from LinkedIn.com. It was sent by a friend(or so I thought), and I clicked on the link. This took me to the LinkedIn website. But I could not sign in. It was when I clicked on the Lost Password link and did not get an email notification that I got suspicious.
Immediately afterwards I started having difficulty in typing. This means that I have to press some keys twice or thrice to get the character to appear on screen. Also keys appear to go wrong at random. One second it works the next it doesn't. I am typing this message with great difficulty.

I tried System Restore. That did not work.
Ran Mal-ware Bytes. See below from Log:

Files Infected:
d:\system volume information\_restore{832726e6-8368-4f68-9949-5fca152ab572}\RP307\A0058095.exe (Hacktool.WGAFix) -> Quarantined and deleted successfully.
d:\system volume information\_restore{832726e6-8368-4f68-9949-5fca152ab572}\RP307\A0058096.exe (Malware.Tool) -> Quarantined and deleted successfully.

Ran Spyware: It came up clean.

Since problem persisted I then followed the advice on Majorgeeks via Read&Run thread on malware removal.
I did everything upto running MGtools. But I made one mistake. I forgot running Combofix after Malware Bytes.
Therefore I ran Combofix after scanning with MGTools.
I decided against re-running the scan sequence in the order recommended, so as to avoid any more mistakes.
Problem still persists. Please advise. I have attached the logs.

Raphee · Feb 8, 2011

Here is the Combofix log.

Kestrel13! · Feb 8, 2011

Firstly I would like to say that I am not seeing any signs of a keylogger, nor am I seeing any malware in those logs. However, what I am seeing is that you have two antivirus installed, one of which needs to be uninstalled immediately.

Kaspersky Anti-Virus 6.0 for Windows Workstations

Microsoft Security Essentials

If you do not use Windows Messenger Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Also delete all files in the below bold folders except ones from the current date (Windows will not let you delete the files from the current day).

C:\WINDOWS\TEMP

C:\Documents and Settings\DELL\Local Settings\TEMP

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Raphee · Feb 8, 2011

Ive followed your instructions as below:
Microsoft Security Essentials removed.
Removed Windows Messenger.
Deleted all files from: C:\WINDOWS\TEMP
C:\Documents and Settings\DELL\Local Settings\TEMP

I have not made any other changes, since I still cannot Type.
What should I do next.

I should highlight that my laptop battery indicator is blinking red although I am on AC power. (battery is almost gone,but on AC the indicator should be green.) This started 3 to4 days ago. Any relevance or am I getting paranoid.

Kestrel13! · Feb 8, 2011

You can post about it in the software forum as this is not topic for the malware forum.

Raphee · Feb 8, 2011

Just wanted to add that I connected an external USB keyboard to my computer and that works fine.

One question: Should I follow the rest of your steps i.e. uninstall Combofix and MGTools etc, and then post in Software forum or should I keep them for now.

Kestrel13! · Feb 8, 2011

Yes. Follow my final steps. Then post in software

Raphee · Feb 8, 2011

Great thanks for the help.

Kestrel13! · Feb 8, 2011

You're welcome. Safe surfing.

Log in or Sign up

Keys cannot type when pressed

Raphee Private First Class

Attached Files:

SUPERAntiSpyware Scan Log - 02-07-2011 - 23-44-44.log

mbam-log-2011-02-08 (12-16-14).txt

RRlog.txt

MGlogs.zip

Raphee Private First Class

Attached Files:

ComboFix.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Raphee Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Raphee Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Raphee Private First Class

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member