i cant figure out if i have a keylogger or trojan :(

DocBrown · 05 Feb 2010

Did you try running MalWareBytes in Win7 SAFE Mode ? Sometimes that get stuff you can not get in Normal Mode

Jacee · 05 Feb 2010

Silent Runners log is showing nothing suspicious.

brady, you say you see the infection ... What, if I may ask, do you see infection-wise?

Jacee · 05 Feb 2010

Download Secunia's Personal Software Inspecter, run a scan and update any vulnerable programs it finds:
Download - Personal (PSI) - Vulnerability Scanning - Secunia.com

You can also clear your Java cache. Open the control panel, click on the Java icon (coffee cup), click on 'settings' and delete the files.
Restart your computer.

Make sure you have all of Windows security patches installed.

D3ftOn3Z · 05 Feb 2010

Thanks Jacee. Glad you could help TS. :)

GEWB · 06 Feb 2010

Thinking out loud her...perhaps a "man in the middle" attack on your WoW account?

Just curious - why are you running the "On-screen Keyboard" accessibility tool?

Accessibility Tools:
--------------------
HKCU\Software\Microsoft\Windows NT\CurrentVersion\AccessibilityTemp\"osk" = dword:0x00000000
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs\osk\
"Description" = "On-screen Keyboard"
"StartExe" = "C:\Windows\System32\osk.exe" [MS]

Regards,
GEWB

blitzgp · 06 Feb 2010

i ran a total of a dozen different scanners of all types, and in multiple configurations. safe mode, with the wow launcher running, with the wow exe running.

i was running the on screen keyboard as a temp thing for passwords. i was told the osk doesnt register as a human interface device, and 90% of keyloggers dont look for it or cant pick up what it is doing.

another random thing happened, was when i ran the repair feature and checked all of the files, the launcher was fixed, but as soon as it was replaced, it would get over written instantly.

i just decided to format and reinstall windows. i just think that it was too specifically written, that they only had to bypass the security to get it on my computer, and then get it off my computer via some type of email.

thanks for your help, and if i hear back from blizzard about what it was and how it got there, ill follow up here (theres probably hundreds if not thousands of people that have this and dont know it).