help please. possible keylogging infection?

posted_2

The keylogging message that started this off

LGG_2

it was in the report and statistics section.view transaction protectionblocked access section. when i clicked on there there was one keylogging attempt from march i think from msnmessenger possibly and the other from a file that was happening vertually everytime i went on any website. theres the date and time next to it and u could see it was happening pretty much constantly. its not now though.

posted_2

"other from a file that was happening"

which file

LGG_2

Combofix has deleted 2 files and I cant see any other signs of infection

do u remember what those files were as im wondering if one was the one that was coming up on my norton and showed up in one of the scans. and thats why its gone when i check norton re the keylogging security bit i mentioned in my last post

LGG_2

posted wrote: »

"other from a file that was happening"

which file

let me have a look back in this thread i think i posted it

LGG_2

i "think" the below was it

C:\WINDOWS\system32\ctfmon.exe

posted_2

That file is part of windows (unless it has been overwritten), are you saying that the norton log that warned you of a keylogging attempt said that this file was responsible?

LGG_2

yes. it gives the file and then says what the attempt is and the dateand time. pretty sure it was that

LGG_2

i did download something onto my site claiming to be from windows which is what i think may have cause this so maybe it was overwritten if thats what it means

posted_2

Your posts are giving a bit of a mixed message, I think, and pretty sure, suggests you are guessing, have a look at the log again to be 100% sure.