Sailor Ben

sailorben · Mar 16, 2009

Hi

I am a new member, so please be gentle.

For about a month now I have noticed that my keyboard does not seem to work correctly and misses out keystokes on many occassions. First noticed it when typing passwords. I eventually got around to carrying out a full scan wth my current anti spyware as supplied by British Telecom Broadband. this told me that I had 1 spyware

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\un\ctfmon.exe.

Despite either deleting or quarantening this malware it just comes back. So joined major geeks and followed 'chaslang' s malware removal guide. Using superantispyware, Malwarebytes anti-malware, combofix and mgtools. I printed out andfollowed all guides (except that I forgot that in my attempts to removethis spy I had intalled ThreatFire and forgot to disable it - though I did allow all scans to proceed when TF warned of them).

Having retarted my PC and run spyware I found that the spy was still there as above. I have attached the various logs and hope that someone can help me please. Thanks Ben.:confused

sailorben · Mar 16, 2009

Last Log attached, Thanks.

chaslang · Mar 18, 2009

Welcome to Major Geeks!

Your antispyware program is incorrect. ctfmon.exe is a well known Microsoft startup file related to MS Office. You can read about it here: Frequently asked questions about Ctfmon.exe

Keyboard problems are more than likely a physical problem with your keyboard. Try another keyboard.

Your logs are clean but you should do the below.

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

If you are not having any other malware problems, it is time to do our final steps:

We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.

If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)

Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required

"%userprofile%\Desktop\combofix" /u

Notes: The space between the combofix" and the /u, it must be there.

This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.

Delete the C:\combofix folder from combofix (if it exists)

Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.

If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.

Go to add/remove programs and uninstall HijackThis.

You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip

After doing the above, you should work thru the below link:

How to Protect yourself from malware!

sailorben · Mar 20, 2009

Many thanks for your help, I have now carried out all of your suggestions and if nothing else my pc is running much better and I am reassured.

Thanks again for your time and help

Sailor Ben

chaslang · Mar 23, 2009

You're welcome. Surf Safely!

Log in or Sign up

Sailor Ben

sailorben Private E-2

Attached Files:

SUPERAntiSpyware Scan Log - 03-16-2009 - 09-48-17.log

mbam-log-2009-03-16 (12-07-02).txt

ComboFix.txt

sailorben Private E-2

Attached Files:

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

sailorben Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member