Problems with keylogger; invisible to all scans?

DragonBuster · Feb 8, 2011

Don't really know how to format these types of requests, so I'll just cut to the chase. About two mornings ago, I logged onto my computer to find that the majority of my emails and various log-in information for other programs (games, etc.) were compromised and changed, leading me to believe that my system was infected with a keylogger virus of some kind.

As this had happened to me once before, roughly 3 or 4 months ago, I was familiar enough with the steps to retrieve control over my accounts and start the removal process. At a friend's recommendation, I had downloaded Avira (AntiVir, as I think it's called on this forum?) and the program scanned, found, and removed the virus without trouble.

This time, however, I am completely at a loss. Avira and avast!, which I foolishly used to keep idle at the same time (I only ran one scan at a time, but both were running their real-time scanning abilities simultaneously), picked up only one instance of any sort of warning - whenever I would start a full system scan with avast!, Avira would flag the entire program as being infected with the TR/Crypt.XPACK.Gen malware about every fifteen to twenty seconds, saying that it detected it in C:\Windows\Temp\_avast_\ under various .tmp files.

I've gone through the entire procedure list found in the READ and RUN ME FIRST thread you have on this forum, and have had only one error, admittedly a somewhat disturbing one - RootRepeal crashes into a blue-screen and causes a system restart during the scanning process whenever I start it, and it always crashes at roughly the same interval - either at C:\WINDOWS\System32, or at C:\WINDOWS\winsxs. The blue screen has a wall of text about what exactly crashed, but as it only stays up for a brief moment before crashing and restarting the computer, I cannot seem to catch any of it.

I've attached the remaining four logs into this thread. Please, if someone can find the time to help me with this, I would appreciate it. I'm not concerned exactly with the safety of my accounts, as I've retained full control of them since then, but I don't feel safe in any way operating my computer, and would like this fixed if at all possible.

Thank you for your time,
DB

P.S. - Although this isn't pertinent to the below logs, I also have experienced the exact same problems on my laptop (this thread is for my desktop), including the problems with the RootRepeal. I do not know if it will be possible to utilize the same solution for both computers, however, and although I know of your policy to use a different thread for each computer that has problems, I was of the opinion to mention said problem, and wait for a response in case the solution will work for both computers.

*EDIT: Forgot to add the logs. They should be enclosed now.

Kestrel13! · Feb 8, 2011

Hi there and welcome. I am currently reviewing your logs and will get back to you with a set of instructions in the next post I make to you.

Kestrel13! · Feb 8, 2011

Do not fret about RootRepeal. It only has a 50-50 chance of running anyway.

Now we need to use ComboFix

Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!

If it is not on your Desktop, the below will not work.

Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.

If ComboFix tells you it needs to update to a new version, make sure you allow it to update.

Open Notepad and copy/paste the text in the below quote box. Ensure you scroll down to select ALL the lines:
Code:
KILLALL::

RegLock::
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\Default_Monitor\4&3b1740d6&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\Default_Monitor\4&3b1740d6&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\HWP26A2\4&3b1740d6&0&UID256\Device Parameters\MODES]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\HWP26A2\4&3b1740d6&0&UID256\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\HWP26A2\4&3b1740d6&0&UID256\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\HWP26A2\4&3b1740d6&0&UID852224\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\system\ControlSet001\Enum\DISPLAY\HWP26A2\4&3b1740d6&0&UID852224\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
Registry::
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\NoExplorer]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{43DA6A3C-250C-48EF-8071-3D3D22D71ABB}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{43DA6A3C-250C-48EF-8071-3D3D22D71ABB}]
Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe

At this point, you MUST EXIT ALL BROWSERS NOW before continuing!

You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.

Now use your mouse to drag CFscript.txt on top of ComboFix.exe

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Follow the prompts.

When it finishes, a log will be produced named c:\combofix.txt

I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

but I don't feel safe in any way operating my computer, and would like this fixed if at all possible.
Click to expand...

Maybe you should take a look at the "How to protect yourself from malware" link which you will see in my final steps when we are done.

I am not seeing any signs of malware in your logs. The small fix above was just to address some miscellaneous items.

Attach the combofix log and then we should be ready for final steps.

DragonBuster · Feb 8, 2011

I have followed your directions and attached the new ComboFix log as requested. It ran just fine, as it did before.

Maybe you should take a look at the "How to protect yourself from malware" link which you will see in my final steps when we are done.

I am not seeing any signs of malware in your logs. The small fix above was just to address some miscellaneous items.
Click to expand...

I have glanced at the link, and although I only really got a small bit of new information from it (mostly the firewall information, as I seem to need to upgrade), the fact is that I've tried most, if not all of the programs on that list. This is the second time in less than a four month time frame that I've been hacked on two separate computers, at exactly the same time, when they have no interaction or even a connection between the two. Even more frustrating is that even though I know I'm being hacked (as evidenced by my Gmail telling me that people from China have been accessing my account, and being an American who has never traveled, is eye-opening), there's nothing that seems to be finding these viruses.

It is starting to upset me greatly, as I consider myself a competent computer user, and always try to create the best possible protections for my files. It's very unsettling to have to go through these situations repeatedly, in such a short time frame, when I seem to be doing everything right - even following the same principles you list in your "How to protect yourself from malware" thread.

I'm at a complete loss here.

Regardless, here is the combofix log, as requested:

Kestrel13! · Feb 9, 2011

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /uninstall

Notes: The space between the combofix" and the /uninstall, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Go back to step 6 of the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
related to MGtools and some other items from our cleaning procedures.

If you are running Win 7, Vista, Windows XP or Windows ME, do the below:

Refer to the cleaning procedures pointed to by step 7 of the READ ME
for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.

Then reboot and Enable System Restore to create a new clean Restore Point.

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

Log in or Sign up

Problems with keylogger; invisible to all scans?

DragonBuster Private E-2

Attached Files:

Combofixlog.txt

SASlog.txt

MGlogs.zip

MBamlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member

DragonBuster Private E-2

Attached Files:

CFlog.txt

Kestrel13! Super Malware Fighter - Major Dilemma Staff Member