Solved Undetectable Virus that disables keyboard and file opening functions?

[Doag]

Nothing is found with updated Virus/Malware scans, keyboard stops working, programs and folders don't open directly.

The symptoms my computer is displaying are:

*--Keyboard stops working (Mouse still works fine)
*--Folders and Program icons lead to their "Properties" window instead of normal opening function. They can be opened by right-clicking and "open".
*--Things seem back to normal after restart, until they happen again..
*--Updated Virus/Malware scans don't find anything.

Months ago my Gmail account was hacked by someone in "Vietnam" and I was able to change all of my passwords and retreive exclusive access to my account. I think a popup or malware (I'm careful about what I install) began logging my keystrokes. Around the same time my other email account started getting warnings of suspicious activity.

Nothing has ever been found by Malwarebytes, AVG, Avast, iObit etc. I've tried all of them with the updated definition files. The physical aspects of my keyboard chord are completely fine, it's not the connection..

I have a feeling someone gained access to my keystrokes and maybe that malware/virus is jamming my keyboard??

 

[Doag]

update

I saw another thread which talked about Rogue Killer, I ran that and it found 2 HJ DESK registry entries..

"[HJ DESK] [PUM] HKLM\... NewStartPanel :..."

I used the delete option.. I don't know if these were of any significance or not.. but it's more than other programs have found in a while.

 

[Jacee]

Download DDS from one of these links:
DDS.com
DDS.pif

• Disable any script blocking protection
• Double click the dds icon to run the tool.
• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt <--- will be minimized in the task tray
• Save both reports to your desktop.

Include the contents of both logs in your next post.
The scan will instruct you to post Attach.txt as an attachment.

 

[Doag]

Jacee: thanks for taking the time!! I'm sending them both as attachments because the message length was too long.. Let me know if anything stands out as wrong

 

[Jacee]

First, let's see how much 'adware' is on your machine.


Please download AdwCleaner by Xplode and save to your Desktop.

• Double click on AdwCleaner.exe to run the tool.
  Vista/Windows 7/8 users right-click and select Run As Administrator.
• Click on the Scan button.
• AdwCleaner will begin...be patient as the scan may take some time to complete.
• After the scan has finished, click on the Report button...a logfile (AdwCleaner[R#].txt) will open in Notepad for review (where the largest value of # represents the most recent report).
• The contents of the log file may be confusing. Unless you see a program name that you know should not be removed, don't worry about it. If you see an entry you want to keep, let me know about it.
• Copy and paste the contents of that logfile in your next reply.
• A copy of all logfiles are saved in the C:\AdwCleaner folder which was created when running the tool.

 

[Doag]

Thanks

# AdwCleaner v3.017 - Report created 22/01/2014 at 17:26:58
# Updated 12/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Doag - Doag-PC
# Running from : C:\Users\Doag\Downloads\AdwCleaner.exe
# Option : Scan

***** [ Services ] *****


***** [ Files / Folders ] *****

File Found : C:\Users\Doag\AppData\Roaming\Mozilla\Firefox\Profiles\vyx2wwwg.default\user.js
Folder Found C:\Program Files (x86)\Conduit
Folder Found C:\ProgramData\Partner
Folder Found C:\Users\Doag\AppData\Local\Conduit
Folder Found C:\Users\Doag\AppData\LocalLow\Conduit

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Software\SmartBar
Key Found : HKCU\Software\AVG SafeGuard toolbar
Key Found : [x64] HKCU\Software\AVG SafeGuard toolbar
Key Found : HKLM\Software\AVG SafeGuard toolbar
Key Found : HKLM\Software\AVG Security Toolbar
Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Found : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Found : HKLM\Software\Conduit
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASAPI32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASMANCS
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16750


-\\ Mozilla Firefox v25.0.1 (en-US)

[ File : C:\Users\Doag\AppData\Roaming\Mozilla\Firefox\Profiles\vyx2wwwg.default\prefs.js ]


-\\ Google Chrome v32.0.1700.76

[ File : C:\Users\Doag\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage
Found : homepage
Found : homepage

*************************

AdwCleaner[R0].txt - [1971 octets] - [22/01/2014 17:26:58]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [2031 octets] ##########

 

[ShamrockRig]

I see a good few entries from "Conduit" which can hijack browser home pages and replace it with their own, it can also be a suspect of slowing down systems, id advise you run this also just to be on the safer side of things.

Please download Junkware Removal Tool to your desktop.

• Shut down your protection software now to avoid potential conflicts.
• Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete depending on your system's specifications.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message.

 

[Doag]

Thank you

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Doag on Thu 01/23/2014 at 10:02:43.52
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mconduitinstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mconduitinstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\mconduitinstaller_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\mconduitinstaller_RASMANCS
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D4962FE8-6F48-4537-A563-4501367BB623}



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Thu 01/23/2014 at 10:35:31.69
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

[ShamrockRig]

Another good few registry entries from conduit, il post back later on with a few more programs, I'm on my iPhone at the minute so I can't, cheers

 

[Jacee]

finish cleaning up with AdwCleaner:


Using AdwCleaner v3: Scan & Clean:
Double click on AdwCleaner.exe to run the tool again.
Click on the Scan button.
AdwCleaner will begin to scan your computer like it did before.
After the scan has finished...

This time click on the Clean button.
Press OK when asked to close all programs and follow the onscreen prompts.
Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
After rebooting, a logfile report (AdwCleaner[S#].txt) will open automatically (where the largest value of # represents the most recent report).
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder


Next, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

 

[mircea2908]

Hello. I have the same problem. I tried everything said above and still no result.

 

[mircea2908]

Omg....it seemed that my alt key was pressed which made my pc go crazy...sorry for this post maybe will help someone else.

 

[enbeen]

Have the same problem. I tried everything ablove and it's solved
I registered this account just to say thank
Thank you!

 

[Jacee]

Well, thank you for joining!

 

[dionysip]

Hello,

I need your help! Especially from Jacee. I face exactly the same problem with Doag which means:

*--Keyboard stops working (Mouse still works fine)
*--Folders and Program icons lead to their "Properties" window instead of normal opening function. They can be opened by right-clicking and "open".
*--Things seem back to normal after restart, until they happen again..
*--Updated Virus/Malware scans don't find anything.


I have followed your advise up to the point that I have installed Adware and took back the report. However, as the last post here is almost a year ago I would like to know if I should continue follow the instructions till the end. I found similar logs in the report from Adware as you may see below. The Conduit entries appear to me as well. Please further advise if I should continue the way you did the last time or if there is a quicker or different option. Cheers!


***** [ Folders ] *****

Folder Found : C:\ProgramData\Conduit
Folder Found : C:\ProgramData\TweakBit
Folder Found : C:\Users\Denis\AppData\LocalLow\Conduit
Folder Found : C:\Users\Denis\AppData\Roaming\MPC
Folder Found : C:\Users\Denis\AppData\Roaming\RPEng

***** [ Files ] *****

File Found : C:\END

***** [ DLL ] *****


***** [ Shortcuts ] *****


***** [ Scheduled tasks ] *****


***** [ Registry ] *****

Key Found : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp
Key Found : HKCU\Software\Google\Chrome\Extensions\fcfenmboojpjinhpgggodefccipikbpd
Key Found : HKCU\Software\Classes\CLSID\{66E8DCC7-97D2-4A89-8E08-D0610FF0878C}
Key Found : HKCU\Software\Classes\CLSID\{7473B6BD-4691-4744-A82B-7854EB3D70B6}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68}
Key Found : HKCU\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKCU\Software\AppDataLow\Software\BackgroundContainer
Key Found : HKCU\Software\AppDataLow\Software\BackgroundContainerV2
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}
Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827}

***** [ Web browsers ] *****

[C:\Users\Denis\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Found : hxxp://search.conduit.com/?ctid=CT2269050&SearchSource=48
[C:\Users\Denis\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Startup_URLs] Found : hxxp://searchinterneat-a.akamaihd.net/h?eq=U0EeCFZVBB8SRggQeA0PBVpDQxhCJloOTA0TF1EOIVoJBBRDFgETJFwLU10UEVEFIk0FA1oDB0VXfV5bFElXTwhkMlxZFX8YT1E=
[C:\Users\Denis\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : ahilkiibpgjnonbhdfkkgjddddmapala
[C:\Users\Denis\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : ejpbbhjlbipncjklfjjaedaieimbmdda
[C:\Users\Denis\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : fcfenmboojpjinhpgggodefccipikbpd
[C:\Users\Denis\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] [Extension] Found : plmlpkfpkijnlijgalnjaacllnjmoamo

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2877 bytes] ##########

 

[id02]

Hi Devlin1888,

thanks for the solution that you posted and it worked for me , but partially .
when I run the JRT everytime my system recovers and keyboard starts functioning.
but wheni restart my laptop or shut down the system , keyboard is non functional , running JRT recovers it.

Please help!!!!!

 

[Jonstori]

Joined this forum just to say thanks! I had the exact same problem as Doag - keyboard wouldn't work, files didn't open, etc.

The solutions suggested by Jacee and Devlin1888 worked and my desktop is operating as normal. Really appreciate the knowledge and kindness of people here!