6 replies to this topic

[elveez]

I just found this file in my Malwarebytes quarantine:

Vendor: Trojan.Agent
Category: File
Items: C:\WINDOWS\sustem32\KerndDrv.dll
Reference#: 35638

Does anyone knows that this is? I tried searching but found nothing. Any ideas?

[AdvancedSetup]

Hello elveez and Welcome to Malwarebytes

According to Threat Expert

Quote

Infostealer.Gampass [Symantec]

A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)

* There was application-defined hook procedure installed into the hook chain (e.g. to monitor keystrokes). The installed hook is handled by the following module:
o %System%\KerndDrv.dll

Highly recommend that you follow the directions below (do not bypass the online Panda scan)

Please read and follow the instructions provided here: Pre- HJT Post Instructions
When ready please post your logs here: Malware Removal - HijackThis Logs

Someone will be happy to assist you further with cleaning your system.

During this scan and cleanup process you should not install any other software unless requested to do so.

[elveez]

Thanks a lot! I had some on of my passwords stolen and I figured it's gotta be some keylogger. I wish I could figure out how I got this one! I had Norton Realtime protection and SpyBot with TeaTimer running all the time!

I just scanned my system with Norton + Malwarebytes + SpyBot + SuperAntiSpyware and it seems that I'm clean now. Malwarebytes was the only one program that reported this!!

I will run it again and post the logs here. Do I just copy and paste them here or should I include them as an attachment?

[elveez]

Here's my MBAM log from two days ago when the files were found...

[elveez]

HijackThis Log. Today. Panda is still working, I will post the log as soon as it's done.

[AdvancedSetup]

Please don't post your logs here.

Start a new thread here: http://www.malwareby...php?showforum=7

Then post current MB and HJT and PANDA logs in the new thread. Do not attach the files, post them directly please.


Thank you.

[elveez]

Thanks! Will do!