help please. possible keylogging infection?

aliEnRIK

Combofix has deleted 2 files and I cant see any other signs of infection

Please do a scan with Kaspersky Online Scanner
(Needs to be run using internet explorer)

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

Click on the Accept button and install any components it needs.

• The program will install and then begin downloading the latest definition files.
• After the files have been downloaded on the left side of the page in the Scan section select My Computer
• This will start the program and scan your system.
• The scan will take a while, so be patient and let it run.
• Once the scan is complete, click on View scan report
• Now, click on the Save Report as button.
• Save the file to your desktop.
• Copy and paste that information in your next post.

If this comes back clean id say your good to go (did you uninstall norton or not?)

LGG_2

right im back. yes i did unistall norton cause i thought thats all i could do. butive reinstalled itn ow and everything back as normal. right ill go for the online scan now.

so u can see nothing that suggests theres keylogging going on??

LGG_2

its telling me to install java so doing that

aliEnRIK

Well possibly the files that combofix removed had something to do with keylogging. Its very hard to say to be honest

Kaspersky has one of the best scanning engines around so if that cant find anything as were your ok

LGG_2

its scanning now. mentioned about tuning off other AV but i havnt.but it seems to be ok. will it be as effective?

aliEnRIK

Not sure. Id stop Norton from running personally as you dont really want to be complacent where key loggers are concerned

LGG_2

how do i do that though without uninstalling it. and touch wood so far when ive looked on my reports on norton where as b4 vertually every site i was going on was coming up as blocked keylogging attempt up to now theres nothing and even though im not getting the padlock sign iam getting the theu are now entering a secure page pop up. so something seems to be working

posted_2

What is the exact detail of the norton message?

Norton hasn't stopped all those infections, so assuming your subscription is upto date, you might want to try a different resident scanner.

btw, If you had a rootkit, no online or resident scanner would find it, the only sure way is to use a boot cd scanner.

aliEnRIK

I personally dont touch Norton so unsure. But it SHOULD be a simple case of RIGHT clicking the symbol in the control panel and shutting its 'resident scanner/shield/guard/" down

Ive had a quick google and I dont know which version of Norton youi have but they should be similar instructions ~

[FONT=trebuchet ms,geneva]If you want to manually shut down Norton 360 completely, you may need to get into Settings of Norton 360 and disable each protection individually.[/FONT]
[FONT=trebuchet ms,geneva]1. Under Quick Controls, uncheck Identity Safe and Phishing Protection.[/FONT]
[FONT=trebuchet ms,geneva]2. Click Virus & Spyware Protection. Under Automatic Protection Settings tab, uncheck Turn on Auto-Protect, Turn on SONAR, Turn on Suspecious Activity Monitoring, and Turn on Email check. [/FONT]
[FONT=trebuchet ms,geneva][/FONT][FONT=trebuchet ms,geneva]
[/FONT]

LGG_2

What is the exact detail of the norton message?

which message.

half way through the scan and ive got one threat name and one infected object. although cant tell yet what they are. ie serious or not