Solved 45,120 events in event viewer, I have a keylogger

[gregrocker]

What exactly told you that you had a keylogger?

If you want to try the AHCI setting using the method VistaKing linked in Post #2, I'd save a Win7 backup image externally first. Backup Complete Computer - Create an Image Backup

 

[cottonball]

Amingst,

We need to rule out the possibility of a TDSS Rootkit that hides by infecting a system driver, like atapi.sys, or, iastor.sys.

Please download TDSSKiller.zip:
http://www.bleepingcomputer.com/download/tdsskiller/
Right-click the program and select: Extract to tdsskiller\

You will see a TDSSKiller folder found on your Desktop.
Open the folder, and double-click the TDSSKiller application.

When the TDSSKiller console opens, click on: Change Parameters
Under Additional Options, place a check in the box next to: Detect TDLFS File System
Click: OK

Press: Start Scan

If a suspicious object is detected, the default action is Skip, leave it as is, and click on: Continue
If malicious objects are found, they show in the Scan results.
Ensure Cure (the default) is selected, then click: Continue > Reboot now, to finish the cleaning process.
(Note: If Cure is not available, select Skip, >>Do not select: Delete<<)

When done, the tool outputs its log to the disk with the Windows Operating System, normally C:\

Logs have a name like:
C:\TDSSKiller.X.X.X_12.04.2013_15.31.43_log.txt

Please post the TDSSKiller log in your reply.



Also download SystemLook:
64-bit: http://jpshortstuff.247fixes.com/SystemLook_x64.exe

Right-click on SystemLook.exe, and select: Run As Administrator

Copy the content of the following quote box into the main textfield (do not copy the word 'Quote'):

:filefind
iaStor.sys

Click the Look button to start the scan.

When finished, a notepad window opens with the results of the scan.

Please post the SystemLook.txt (found on the Desktop) in your reply.

 

[Amingst]

I called support and they said since 45k events were in event viewer and I couldn't run disk check that I had a keylogger

 

[VistaKing]

Amingst

You don't have a key logger what you have is more of a rootkit. If you go to your post in the System Security thread Cottonball and Jacee will be glad to get that removed from your computer .

 

[Amingst]

I called support... They said that since I had 45k events in event viewer and that I could not run disk check when scheduled at startup that I had a keylogger.

At this point I really want to stop the BSOD with code 0xD1 causes by iastorA.sys

 

[cottonball]

Amingst,

We understand the frustration that may be caused by the current situation the computer is in.
If there is a rootkit involved, we need to find out what kind it is, in order to use the correct tools to remove it.

To resolve your problem, you need to stay cool, have some patience, and follow the instructions
posted above.

 

[cottonball]

At this point I really want to stop the BSOD with code 0xD1 causes by iastorA.sys

Well sure. That's the goal.

However, if you have a TDSS Rootkit that hides by infecting iastor.sys, it's not going to happen.

Go back to Post # 12, in the System Security forum, and follow those instructions.

Otherwise... :banghead:

 

[ICIT2LOL]

Amingst,

We understand the frustration that may be caused by the current situation the computer is in.
If there is a rootkit involved, we need to find out what kind it is, in order to use the correct tools to remove it.

To resolve your problem, you need to stay cool, have some patience, and follow the instructions
posted above.

+1 for me too mate it will get sorted

 

[Britton30]

I called support... They said that since I had 45k events in event viewer and that I could not run disk check when scheduled at startup that I had a keylogger.

Friend, translated that means, "we don't have a clue what's wrong with your PC, good luck". Please try the suggestions given. Keyloggers are fairly rare.By the way, that's not an uncommon number of events either, I have 95,561 just in system logs.

 

[Amingst]

could fragmented iaStorA.sys Driver files be the cause of my BSOD with from that. I found that those driver files were fragmented

 

[gregrocker]

No it could not. Why are you ignoring the steps carefully written out for you by Cottonball, prattling on about irrelevant nonsense while a resident expert here is trying to get you focused on the steps required?

Do the disinfection required then continue with Troubleshooting Windows 7 Failure to Start
running Startup Repair - Run up to 3 Separate Times and SFC /SCANNOW Run in Command Prompt at Boot.

The steps eventually lead up to if necessary running a Clean Reinstall - if you'll stick with the tools and methods given for that then you'll get and keep a perfect install.

 

[Amingst]

they are not working, im just going to reinstall my os

 

[Amingst]

here are the files you asked for in post 22

 

[Britton30]

You asked a question . You got it answered you didn't ask if it was free or paid.

It's a difference, the question was half answered. Try not to answer in riddles, it's no gelp to the OP, which is why we are here.
I can say Jacee is likely the top security expert here and known in several security forums.

 

[cottonball]

Thanks, Amingst.

TDSSKiller came out clean, however, that has happened before, and other tools find the problem.

You can run: aswMBR
http://public.avast.com/~gmerek/aswMBR.exe
Save it to the Desktop.


>>Make sure your AntiVirus is temporarily disabled!!<<

For information on how to disable protective programs, refer to this Info:
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs - BleepingComputer.com


Right-click aswMBR and select: Run as Administrator


When promped with: This Application can use the Avast! Free AntiVirus for scanning...etc.
Select: Yes


The last line of the run in progress will provide the status of the Avast! scan.
It will say: Downloading Avast! virus definitiond database, etc.

When the Avast! scan is done, the last line changes to: Avast Engine definitions #####


At this point, click the Scan button on the lower left of the aswMBR screen.
The last line will now say "Scanning" while it is in progress.


Upon completion of the scan, click >Save log< and save it to the Desktop.
Note: Please do NOT attempt to fix anything!!

Exit the program.


Please post the new aswMBR log in your reply.




Also, notice that another file is created on the Desktop.
It is named MBR.dat.


Please submit MBR.dat for analysis to VirusTotal:
http://www.virustotal.com/

http://www.sevenforums.com/tutorials/277740-online-scanners-scan-suspicious-files-your-pc.html


If you get a message saying: 'File has already been analyzed', click: Reanalyze file


Once scanned, and you see the full results page on your screen, go up to the address bar at the top of the browser, and copy the http:\\etc. address there.


Then, provide the http:\\ address to the results page in your reply.

 

[Amingst]

the scan has not finished yet but I have noticed that it only crashes in high performance power setting. Is there any connection?

 

[Amingst]

I have completed the scan. Here it is

 

[Amingst]

I have found out that updating the iastor.sys drivers with the installer did not update iaStorA.sys i will try to update them manually

 

[cottonball]

Amingst,

On Post #35, please follow the instructions to submit MBR.dat for a Scan at VirusTotal.

Thanks.

 

[Amingst]

I submitted the files for scan, they came back negative for any viruses/rootkits