keyboard virus - help

[jeffbrown17]

Certain keys on laptop keyboard are weird, asterisk when I hit "P" key, 5 when I hit "O" key, etc. External keyboard hooked up via USB 2.0 works fine. This happened last summer (before I had external keyboard) and repair guy that I called out to come fix it said that something bad had entered via toolbars I had unwittingly installed.

He took laptop away, had to remove all my docs/data and then reinstall. He charged me $228 and told me to run Adaware, SpyBot, Norton, plus defrag, once a week. Which I have done faithfully since then.

Norton didn't catch it then, catches nothing now. I saw earlier posts on this forum and went and installed HiJack this, and unzipped it and ran it. There were some error messages that came up, of course I couldn't capture them coud only click OK and proceed. Here is logfile from Hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 6:44:43 PM, on 12/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CMS Peripherals\BounceBack Express\BBLauncher.exe
C:\Program Files\Belkin\F1U201.401\usbshare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\HJT\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.gatewaybiz.com/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BounceBack Launcher.lnk = ?
O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
O4 - Global Startup: F1U201.401.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1151542746834
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1162584507109
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: .NET Runtime Optimization Service v2.0.50727_X86 (clr_optimization_v2.0.50727_32) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (file missing)
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Any help appreciated.

Thanks.

Jeff Brown

[caperjack]

Certain keys on laptop keyboard are weird, asterisk when I hit "P" key, 5 when I hit "O" key, etc. External keyboard hooked up via USB 2.0 works fine. This happened last summer (before I had external keyboard) and repair guy that I called out to come fix it said that something bad had entered via toolbars I had unwittingly installed.

So its been broke since last summer.,actually the reinstall should have fixed it if it were a viruse or some other nasty .

He took laptop away, had to remove all my docs/data and then reinstall. He charged me $228 and told me to run Adaware, SpyBot, Norton, plus defrag, once a week. Which I have done faithfully since then.

he ripped you off ,i do the same thing for 40 dollars or less .

Norton didn't catch it then, catches nothing now. I saw earlier posts on this forum and went and installed HiJack this, and unzipped it and ran it. There were some error messages that came up, of course I couldn't capture them coud only click OK and proceed. Here is logfile from Hijack this:

i did a quick look at the scan ,i don't see anything that could cause the keyboard problem ,may just be a bad keyboard.

[jeffbrown17]

Great thanks for looking at the logfile for me, and your responses!

Yes I am going to take into a place next week where I went to get a key replaced a couple of months ago to see what they say re: keyboard being faulty.

Everything is running fast and fine no "cognitive" issues, so to speak. Just weird keyboard.

Thanks again.

Jeff Brown

[Davelray]

This is a laptop right? Last time I checked, laptop keyboards have the numeric pad associated with standard keyboard keys. For instance on my Thinkpad if I turn Num Lock on then P becomes *, U becomes 4, I becomes 5, etc. Look for how to toggle num lock off and on.

[caperjack]

This is a laptop right? Last time I checked, laptop keyboards have the numeric pad associated with standard keyboard keys. For instance on my Thinkpad if I turn Num Lock on then P becomes *, U becomes 4, I becomes 5, etc. Look for how to toggle num lock off and on.

I actually thought that when i first read post ,but seeing someone had fixed it for over 200 dollars I thought ,they would have thought of that too. maybe not though

[Davelray]

I actually thought that when i first read post ,but seeing someone had fixed it for over 200 dollars thought ,they would have thought of that too. maybe not though

Well, I actually forgot to comment on that but I will now. Having worked in the retail side, I've seen people charge for a reload when it was not neccessary. The placed I worked for would even charge for a reload and perform a reload just to get rid of spyware that could have easily been removed without a reload. They charge $100 for a reload of a system. This was one of the many "bad" practices in the retail industry I disapproved of and was a major reason for me leaving. You are going to have people that will either charge to do something unneccessary to fix an issue because they get more money that way, or people that really don't know what they are doing or cannot think outside of the box. In this case, it sounds like the original tech that reloaded the system really ripped them off. You would be surprised how many customers now call me to do little things on the weekends for them because they refuse to go to the retail establishment I used to work at for lack of service or poor service.

*name of retail establishment not revealed to protect the guilty*

Regards,

[caperjack]

Well, I actually forgot to comment on that but I will now. Having worked in the retail side, I've seen people charge for a reload when it was not neccessary. The placed I worked for would even charge for a reload and perform a reload just to get rid of spyware that could have easily been removed without a reload. They charge $100 for a reload of a system. This was one of the many "bad" practices in the retail industry I disapproved of and was a major reason for me leaving. You are going to have people that will either charge to do something unneccessary to fix an issue because they get more money that way, or people that really don't know what they are doing or cannot think outside of the box. In this case, it sounds like the original tech that reloaded the system really ripped them off. You would be surprised how many customers now call me to do little things on the weekends for them because they refuse to go to the retail establishment I used to work at for lack of service or poor service.

*name of retail establishment not revealed to protect the guilty*

Regards,

LOL ,You don't happen to live in my home town do you .local private business with an association to The source ,reloads for all problems ,because that the quickest fix for spyware and viruses ,but having said that they only charge 35.99+ tax for the reload ,the tech works under the table for 3.50 per hrs .so they don't need to charge 100.00 lol,and most people wouldn't pay that much here in my home town anyway . I once put a used hdd in a computer for 80$ parts and labour that a computer store wanted to charge the person $425.00 for a new 60 gig,[2 years ago ] plus labour

[Davelray]

LOL ,You don't happen to live in my home town do you .local private business with an association to The source ,reloads for all problems ,because that the quickest fix for spyware and viruses ,but having said that they only charge 35.99+ tax for the reload ,the tech works under the table for 3.50 per hrs .so they don't need to charge 100.00 lol,and most people wouldn't pay that much here in my home town anyway . I once put a used hdd in a computer for 80$ parts and labour that a computer store wanted to charge the person $425.00 for a new 60 gig,[2 years ago ] plus labour

Well I live in Greenville, SC. I only do side stuff on the weekends and when it does not intefere with spending time with my wife and son. That was another reason I left the retail industry. Because I am a real tech with real experience and real certifications that cost me money both in time, training, and the expense of exams, I generally charge for what my time is worth to me. If it's an emergency situation and will intefere with my normal weekend routine I charge around 60 dollars an hour. If it's something you can drop off to me and I can work on at my liesure, I charge 35 dollars an hour. I do not charge for parts because I will tell you what you need to go buy, and generally where to get it for the best price. And it also depends on what the issue is. For instance if it's obviously a blown modem or network card, I only charge 30 bucks flat out if you bring the pc and a new modem/nic to me or have it handy so that I can "swing" by.

[caperjack]

Well I live in Greenville, SC. I only do side stuff on the weekends and when it does not intefere with spending time with my wife and son. That was another reason I left the retail industry. Because I am a real tech with real experience and real certifications that cost me money both in time, training, and the expense of exams, I generally charge for what my time is worth to me. If it's an emergency situation and will intefere with my normal weekend routine I charge around 60 dollars an hour. If it's something you can drop off to me and I can work on at my liesure, I charge 35 dollars an hour. I do not charge for parts because I will tell you what you need to go buy, and generally where to get it for the best price. And it also depends on what the issue is. For instance if it's obviously a blown modem or network card, I only charge 30 bucks flat out if you bring the pc and a new modem/nic to me or have it handy so that I can "swing" by.

Real Techs are worth there weight in gold [I'm not one ,but i did take a computer maintenence and repair cource ] ,because they actuall fix the problem ,not mask it with a realod . the tech in my post above who wanted the 400+ to install a hdd ,wanted 75.00/hr [1 hr] ,to diagnose problem , then 3 hrs at 75.00/hr to install drive and reload winxp,+ cost of hdda bit much at any experience .

[Davelray]

That is way above and beyond the normal recompensation for installing a hard drive and "reloading." First, if there were no previous issues other than wanting a new, larger hard drive, there would be no reloading. Just simply slave in the new drive, clone the old one onto the new one, remove the old drive and set the new drive up as master and your done. Takes about one hour. My charge, 35 bucks plus the cost of the new drive. Normal "retail" cost is around 30 for installing the new drive and between 75 to 100 dollars for the cloning.

[jeffbrown17]

This is a laptop right? Last time I checked, laptop keyboards have the numeric pad associated with standard keyboard keys. For instance on my Thinkpad if I turn Num Lock on then P becomes *, U becomes 4, I becomes 5, etc. Look for how to toggle num lock off and on.

oK well I am not tech savvy at all so how in the heck does one untoggle a num lock key? I am a very basic click and point user the only stuff I found when I googeld this was a bunch of programming stuff and I'm someone still freaked out by gosubs from Pascal back in high school 1984. Help. Thanks.

[jeffbrown17]

oK well I am not tech savvy at all so how in the heck does one untoggle a num lock key? I am a very basic click and point user the only stuff I found when I googeld this was a bunch of programming stuff and I'm someone still freaked out by gosubs from Pascal back in high school 1984. Help. Thanks.

Hey it's me the original poster I did some searching on these posts and found the answer. The FN key on my laptop keyboard was stuck, b/c I had in advertently hit "num lock" on the USB 2.0 attached keyboard. Once I hit num lock on attched keyboard it reverted to normal.

Thanks.

[caperjack]

Hey it's me the original poster I did some searching on these posts and found the answer. The FN key on my laptop keyboard was stuck, b/c I had in advertently hit "num lock" on the USB 2.0 attached keyboard. Once I hit num lock on attched keyboard it reverted to normal.

Thanks.

great ,glad to see you fixed it ,sorry for ranting in you post .

[Davelray]

I'm just glad we could get you going in the right direction so that you got your problem fixed without getting ripped again. I always feel bad for people that get ripped off by unethical techs. Congrats and hope everything goes ok now.