[Resolved] Suspicious behavior; logins have to be done 1 keystroke at a time

[E310]

I have an external hard drive that's always on. At times, when opening My Documents, for example, that drive will "power up" and the computer will hang until whatever's happening happens. Sometimes that results in the desktop reloading itself (that's explorer, no?) ... as in all the icons disappear and then roll back in. Sometimes when opening My Computer (from the shortcut on the desktop), the screen will go black for a half second.

I don't know. That could be RAM going bad? We're not finding anything else, right? And all of those things are minor annoyances. I don't expect them to be resolved here. What do you think? Convinced enough by Kaspersky to call it?

Eddie

[1972vet]

Sounds like typical behavior to me, especially since that thing is carrying quite a haul. Do you still have to log in, one keystroke at a time? the kaspersky scan seemed to indicate you're using some keyboard software that's foreign to me. Fact is, it's foreign to google. Probably a key logger but it's service configuration is odd for something you wouldn't know about...appears more to me that it's that way for a purpose. You would know more about that than I. But, with that installed, your "weird" behavior is also typical and expected.

Any other issues?

[E310]

I have no idea what you're talking about, Vet. If there's a keylogger, it ain't mine. The keyboard and mouse came with a CD, I installed the software from there. Once you came in to the picture, I downloaded what I thought was the latest software from the microsoft.com website. Then that hippo software we ran brought in another update for the mouse software.

As I logged in right now, and the computer finished coming up, the screen went black for half a second again and the desktop "refreshed." Aside from that, which is relatively new ... after the hippo updates in fact (which listed ATI Radeon updates) ... everything seems A-OK. Typing and logging in is no longer happening one keystroke at a time. That much we cured! Everything else is greek to me.

Before we close this (we're leaning that way, right?) can you give me a hint as to what it was Kaspersky saw so I can make a note of it?

Thanks!
Eddie

[1972vet]

I have no idea what you're talking about, Vet. If there's a keylogger, it ain't mine.
Ok, we can remove it

The keyboard and mouse came with a CD, I installed the software from there. Once you came in to the picture, I downloaded what I thought was the latest software from the microsoft.com website. Then that hippo software we ran brought in another update for the mouse software.
Please refresh my memory...what was it that you downloaded from Microsoft.com?

As I logged in right now, and the computer finished coming up, the screen went black for half a second again and the desktop "refreshed." Aside from that, which is relatively new ... after the hippo updates in fact (which listed ATI Radeon updates) ... everything seems A-OK. Typing and logging in is no longer happening one keystroke at a time. That much we cured! Everything else is greek to me.

Before we close this (we're leaning that way, right?) can you give me a hint as to what it was Kaspersky saw so I can make a note of it?

Thanks!
Eddie

We are almost finished. An idea what Kaspersky saw? Sure, we'll remove it:

Please return to the AVP scanning utility and click the "Manual Disinfection" tab. Click on the Script execution link far right side. Copy and paste the below script indicated in Bold text, into the text window, then click the Run script button.
begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelBHO('{5C255C8A-E604-49b4-9D64-90988571CECB}');
 BC_DeleteFile('C:\WINDOWS\system32\KB905474\wgasetup.exe');
 BC_DeleteSvc('Aemicacnpaw');
 BC_DeleteFile('Aemicacnpaw.sys');
BC_ImportDeletedList;
ExecuteSysClean;
ExecuteWizard('TSW',2,3,true);
BC_Activate;
RebootWindows(true);
end.
 
When it completes, the system will reboot. Post back when the system comes back up and let us know how things are running for you now. Thanks!

[E310]

Here we go ...

Upon restarting, three windows came up:
1. Update to Adobe Flash Player
2. "Microsoft IntelliType Pro has encountered a problem and needs to close. We are sorry for the inconvenience."
3. "Previous application launch failed" from Kaspersky

... and while I was typing this, WinPatrol threw up a new program alert for a startup addition called "_uninst_02685805.bat"

The screen went black again for a half second. But it doesn't "feel" like anything's wrong.

As for what I downloaded from Microsoft, it was an update to the keyboard software/drivers.

Eddie

[1972vet]

So then, it looks like everything went according to plan. The uninstall.bat should be allowed...it relates to the Kaspersky AVP which wants to auto-uninstall when it's closed.

Everything working now as expected? Happy with it's performance?

[E310]

Sure. Everything seems fine.

What's next? ... uninstalling itype, the microsoft software for this keyboard, so I don't have to deal with the startup error every time?

Eddie

[1972vet]

Look in the event log for the error, post it here.

[E310]

Is this what you're looking for, Vet? Or would you like me to restart to get the error and send you a screen shot?

Eddie


Event Type:   Error
Event Source:   Microsoft IntelliType Pro
Event Category:   None
Event ID:   1000
Date:      4/14/2012
Time:      9:51:00 AM
User:      N/A
Computer:   EDDIE-79D17D0FC
Description:
The description for Event ID ( 1000 ) in Source ( Microsoft IntelliType Pro ) cannot be found. The local computer may not have the necessary registry information or message DLL files to display messages from a remote computer. You may be able to use the /AUXSOURCE= flag to retrieve this description; see Help and Support for details. The following information is part of the event: itype.exe, 8.20.469.0, 4e41c8b5, kernel32.dll, 5.1.2600.5781, 49c4f482, 0, 00012afb.
Data:
0000: 00700041 006c0070 00630069 00740061
0010: 006f0069 0020006e 00610046 006c0069
0020: 00720075 00200065 00690020 00790074
0030: 00650070 0065002e 00650078 00380020
0040: 0032002e 002e0030 00360034 002e0039
0050: 00200030 00650034 00310034 00380063
0060: 00350062 00690020 0020006e 0065006b
0070: 006e0072 006c0065 00320033 0064002e
0080: 006c006c 00350020 0031002e 0032002e
0090: 00300036 002e0030 00370035 00310038
00a0: 00340020 00630039 00660034 00380034
00b0: 00200032 00440066 00620065 00670075
00c0: 00300020 00610020 00200074 0066006f
00d0: 00730066 00740065 00300020 00300030
00e0: 00320031 00660061 000d0062 000a

[1972vet]

Have you tried replacing the keyboard batteries?

[E310]

You're starting to make me think that buying this Microsoft keyboard and mouse combo was the worst decision I ever made and is the root of all my problems. I just got them around March 18th, the batteries are brand-spanking new ... like for real.

Should I just uninstall all of this Intelli-junk software and use them with whatever drivers are installed?

Eddie

[1972vet]

Give it a shot. I have a wireless kb and mouse...and have never used the Blue Tooth software that came with them. Microsoft has their own solution and it works well for me. With software comes a need for updates. Microsoft is very good at that. Others aren't so keen on updating to accommodate other hardware/software combinations like Microsoft is. Can't hurt to try...you just might be well pleased.

[E310]

They're gone. What's next?

Eddie

[1972vet]

You can delete these:
DDS and related files
McAfee removal tool
CKScanner
Rooter.exe
Showme.bat
look.txt
AVP

Next...and this is most important, please click start-->run...then copy and paste the Bold text below into the run box and click "OK":

ComboFix /Uninstall

Performing this function will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again for you automatically.

To assist in the prevention of malicious software intrusion and infections, you can begin by reading "How to boost your malware defense and protect your PC"...

Please remember to keep antivirus software on board and always use it's real time protection feature. Run a complete system scan at least once a week...preferably in Safe mode.

A word of caution
Security vendors, in recent years, have partnered with "Ask.com" in providing the "Ask Toolbar" bundled with their download(s).

Although the toolbar is considered to be a Legitimate program, it is nonetheless questionable as to it's behavior. It is alleged to be spyware/adware as the behavior of this application tracks a user's history and sends "search" information to it's servers in order to provide a user with targeted search results, many of these results may also be for questionable web sites. In fairness, one should keep in mind, google does the same thing regarding search results.

This tracking is considered by many of us in the security field, to be offensive.

Some of the "Download links" that I may provide, may also contain this program bundled with it. If you choose not to use it, the bundled software will always contain an "Opt Out" measure via some checkbox. The user can check (or uncheck) this box to prevent the download.

If a user isn't cautious and may have mistakenly installed this program, it can easily be removed via the "Uninstall" string provided with the software. Detailed instructions how to remove the program can be found Here.

If your antivirus program is a licensed version that is about to expire, you can consider using one of these available free on the public domain:

Microsoft Security Essentials
AntiVir Personal Edition Classic
Avast! 4 Home Edition

Those of us in the online safety/security community have tried and tested these programs to determine their abilities. Having in mind, nothing is ever a guarantee regarding computer security, these programs nevertheless, combined with the rest of these recommendations are certain to have an impact in helping to keep your system running free and clear. I personally have been completely satisfied from having tested and used each one of those at one time or another.

Immunize your browser by installing Spywareblaster. What does it do?

• Prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
• Blocks spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
• Restricts the actions of potentially unwanted sites in Internet Explorer.

Keep your anti-virus and spyware definitions up to date. Be sure to scan often.

Web of Trust, (WOT,) warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:

• Green to go
• Yellow for caution
• Red to stop

WOT has an add-on available for both Firefox and IE.

Install the Winpatrol security monitor utility. WinPatrol will alert you to hijackings, malware attacks and critical changes made to your computer without your permission. What I hear most from users is how much they like the startup control feature and it's ease of use. Need help understanding something about Winpatol? Here it is.

Windows Vista and Windows 7 have a software firewall built in and activated by default. This native firewall is a big improvement and is fine by itself. However, there are third party software Firewalls that offer a bit more configuration options.

Below you can choose from several of the freeware Firewalls available on the public domain. Even though you may have a Firewall already installed, keep this list handy should you choose not to renew your subscription for whatever reason. I should also mention, if you choose to use a third party firewall, make certain the Windows firewall is turned off to prevent conflict issues.

...and please remember, you should have only one of these types of third party firewalls running on board:

Zone Alarm...Windows 2k/XP/Vista

Outpost Free

Comodo...I highly recommend this firewall, but it may just be best suited for advanced users.

Stay updated with the most recent Windows patches using Microsoft's Windows Update. Make it easy on yourself, and set this feature to Automatic.

Using an alternate browser can reduce your chance of certain infections installing themselves. I recommend installing Mozilla Firefox. If you don't already have "Firefox", please consider installing and using this browser for surfing.

If you still wish to use Internet Explorer, please make sure you install SpywareBlaster (from above) to protect you from most ActiveX infections.

Run CCleaner often. Please avoid using the "registry" cleaning feature of this utility unless you consider yourself an expert. Contrary to popular thought, the Windows Registry has no need of any "cleaning". I personally challenge anyone to show a substantial benefit from having used any of these "registry cleaning" programs. There is none. Any difference at all is so miniscule that it's nearly impossible to calculate.

On the flip side, rather than any benefit, there is the possibility of slicing out enough pieces of the registry to render things useless...and that includes the operating system.

By default, CCleaner will ask you if you want to backup what is removed, and I suggest you do just that. If you have already used this option and found that something no longer works properly, please find the backup that was created and use it to restore that particular item. Remember, using this to clean the disk is absolutely useful and beneficial. A novice needs only to use the disk cleaning feature...and avoid the registry cleaning aspect. It's not difficult...just don't bother to click the Registry button on the menu.

CCleaner is an excellent...and fast disk cleaning utility that can easily be configured to suit your needs. Often, users find a simple reboot resolves a quirky performance issue which can come about as a result of the collection of temp files while browsing the web...and if you configure CCleaner to run on start up, then your system could be kept running fast and clean with each new user session.

The Yahoo Toolbar is included by default during the installation of the CCleaner utility...if you DO NOT WANT IT, be sure to remove the check from the "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser" option during installation setup or else just download the Slim version (no toolbar...last download link at the bottom of that page)...

Or if you just want to run your on board Disk Cleanup ("Start--> Programs-->Accessories-->System Tools-->Disk Cleanup" ), just open the utility and check off the following:
Downloaded Program Files, Temporary Internet Files, Recycle Bin, and Temporary Files.

Or if you just want to run your on board Disk Cleanup ("Start--> Programs-->Accessories-->System Tools-->Disk Cleanup" ), just open the utility and check off the following:
Downloaded Program Files, Temporary Internet Files, Recycle Bin, and Temporary Files.

Don't forget to check your system's "defragmenter" settings. With Windows Vista, you have the option to set this as a scheduled event. It is best to have your system's "defrag" function scheduled for at least once a week.

So how did I get infected in the first place?
Regards, and Happy Surfing!

[1972vet]

This thread is now closed as the issue appears to be resolved.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.