O.T. Missing Folder/files

I uninstalled Quicktime7 on the 780 to test it and see if that's the problem
but it wasn't. I tested it on eBay and Google/Yahoo and it wouldn't backspace.
I have this download link for Quicktime to replace it if it wasn't the problem.
Is it OK to use?

https://support.apple.com/kb/DL837?locale=en_US

I installed the Rootkit and copied the instructions with screenshot's saved on
both computers. It seems Rootkit found something regarding the Partitions and
I was going to scroll up and see what else it said when the last screen flashed
that the scan had finished with no malware found.

https://postimg.cc/5Q4jVksR

https://postimg.cc/HrcndMtd

https://postimg.cc/wyHjXGYj

https://postimg.cc/ftKTBfMj

https://postimg.cc/QV8MVwq6

https://postimg.cc/nCMcGmgB

https://postimg.cc/Y4Br7s9z

https://postimg.cc/mz8BQZSm


Robert

I re-ran the Rootkit scan so you could see the Partitions

https://postimg.cc/7fH83JtD

https://postimg.cc/4HXMQj5w

https://postimg.cc/9DsnnDbD

https://postimg.cc/Cz1rMG6Z

https://postimg.cc/tngkTbD0

https://postimg.cc/qNKLgjc7

Robert

If you like, we can uninstall each A/V on the 780 one at a time to
check and see if any one of them might be the cause of the backspace
key not functioning. Just tell me which one you want me to start with?

If it's Avast, then this is my download to bring it back along with the others
listed below:

https://www.avast.com/installation-files

SpywareBlaster

http://www.brightfort.com/

SuperAntiSpyware

Spywareblaster:https://www.superantispyware.com/

btw should I keep Sharp keys? I lost it on the 780 when I restored the hd
but it's still on the 8500.

Robert

I forgot Malwarebytes:

https://www.malwarebytes.com/


Robert

Robert in CA wrote:
I uninstalled Quicktime7 on the 780 to test it and see if that's the problem
but it wasn't. I tested it on eBay and Google/Yahoo and it wouldn't backspace.
I have this download link for Quicktime to replace it if it wasn't the problem.
Is it OK to use?

https://support.apple.com/kb/DL837?locale=en_US

Yes, that page should work fine. Since QuickTime for Windows is
no longer made, that's the last version offered.

I installed the Rootkit and copied the instructions with screenshot's saved on
both computers. It seems Rootkit found something regarding the Partitions and
I was going to scroll up and see what else it said when the last screen flashed
that the scan had finished with no malware found.

https://postimg.cc/5Q4jVksR

https://postimg.cc/HrcndMtd

https://postimg.cc/wyHjXGYj

https://postimg.cc/ftKTBfMj

https://postimg.cc/QV8MVwq6

https://postimg.cc/nCMcGmgB

https://postimg.cc/Y4Br7s9z

https://postimg.cc/mz8BQZSm


Robert

The scan is clean. The comment about the partitions
concerns the dumb approach they used.

Partition 1
Partition 2
Partition 3 === entry is empty, normal software would ignore
Partition 4 === entry is empty, normal software would ignore

Only the comments about the first two partitions are relevant.

So no hints about backspace key there.

Paul

Robert in CA wrote:
If you like, we can uninstall each A/V on the 780 one at a time to
check and see if any one of them might be the cause of the backspace
key not functioning. Just tell me which one you want me to start with?

If it's Avast, then this is my download to bring it back along with the others
listed below:

https://www.avast.com/installation-files

SpywareBlaster

http://www.brightfort.com/

SuperAntiSpyware

Spywareblaster:https://www.superantispyware.com/

btw should I keep Sharp keys? I lost it on the 780 when I restored the hd
but it's still on the 8500.

Robert

SharpKeys was only for a look, and the
screen was blank, meaning nobody has been
abusing key mappings. We're done with
that for now.

As for the AV idea, of removing all the AVs,
that's a lot of work. Are you sure you want to
do that ? For Avast, you'd probably need to
download the Cleaner for it as well.

I think we've already looked at the "Run Keys"
in Autoruns, for evidence of something foreign
in there. And since MBAM and MBAR were both run,
and your backspace key problem has been around
for months, any malware, Malwarebytes would
probably have added a definition for it by now.

Paul

Well I only suggested the idea about the A/V because
you had a concern that I had too many and with their
updates etc that it might affect the backspace key?
If we do this then I would need a download link for the
Avast Cleaner.

If I uninstall Avast and check eBay/Google/Yahoo won't
the 780 be open to virus's etc or do I have enough protection
with the other A/V present?

As I said we would test each one at a time (with eBay and
Yahoo/Google) and if the backspace key still doesn't
work I'll re-install it then move on to the next one. It's
true its allot of work but we've tried just about everything
else and found nothing wrong other than mismatched
Mrimgs (which seemed to have corrected itself) and
as you say Microsoft isn't any help. However, if we test
the A/V one at a time then we can at least eliminate
them as the cause or find which one is the problem.

I assume you didn't see anything wrong in Rootkit?

I don't understand what you mean by 'adding a definition'
Meaning what exactly?


Thoughts/suggestions?
Robert

I started the A/V testing; I un-installed/re-installed
Spywareblaster, SuperAntiSpyware and Malwarebytes
and tested them one at a time on eBay/Google/Yahoo
but the backspace key still did not function. The only
one I haven't tested yet is Avast because I need the
Avast Cleanup link.

Robert

Robert in CA wrote:
I started the A/V testing; I un-installed/re-installed
Spywareblaster, SuperAntiSpyware and Malwarebytes
and tested them one at a time on eBay/Google/Yahoo
but the backspace key still did not function. The only
one I haven't tested yet is Avast because I need the
Avast Cleanup link.

Robert


https://www.avast.com/en-us/uninstall-utility

https://install.avcdn.net/iavs9x-xp/avastclear.exe

"Download avastclear.exe on your desktop

Start Windows in Safe Mode

Open (execute) the uninstall utility

If you installed Avast in a different folder
than the default, browse for it. (Note: Be careful!
The content of any folder you choose will be deleted!)

Click REMOVE

Restart your computer
"

Paul

It didn't let me install Avast Clear on the desktop instead it gave me this.

https://postimg.cc/xJB1zhCd


I tried saying NO but then it started running the program instead so I stopped
it and went into Safe Mode and downloaded it and it immediately started to run
then I restarted the computer

https://postimg.cc/QVWt384K

I checked Program and Features to make sure it was gone. Then I checked eBay,
Google,Yahoo for backspacing. It was same as all the others it still didn't function.
So installed Avast again.

So by a process of elimination we have tested all the A/V, VLC media and the keyboard
and Rootkit found nothing or Sharp Keys. I wanted to try to uninstall Sea Monkey to test
it since we've tested everything else but its not listed in Program and Features?

What could it be? I would hate to move forward with this and clone hds with no
backspace function.

Thoughts/suggestions?
Robert

Robert in CA wrote:
It didn't let me install Avast Clear on the desktop instead it gave me this.

https://postimg.cc/xJB1zhCd


I tried saying NO but then it started running the program instead so I stopped
it and went into Safe Mode and downloaded it and it immediately started to run
then I restarted the computer

https://postimg.cc/QVWt384K

I checked Program and Features to make sure it was gone. Then I checked eBay,
Google,Yahoo for backspacing. It was same as all the others it still didn't function.
So installed Avast again.

So by a process of elimination we have tested all the A/V, VLC media and the keyboard
and Rootkit found nothing or Sharp Keys. I wanted to try to uninstall Sea Monkey to test
it since we've tested everything else but its not listed in Program and Features?

What could it be? I would hate to move forward with this and clone hds with no
backspace function.

Thoughts/suggestions?
Robert


The only other suggestion I could see, from someone
who works on malware, is to check the "Run keys".
That's something you would likely see in Autoruns,
and you already had a look there.

Or, you can use Device Manager, find the keyboard,
do Properties, and look in the "Details" for
"Device UpperFilters" and "Device LowerFilters".
There should not be anything in those two.

The "Class UpperFilters" has "kbdclass", which is
a Microsoft entry.

But I don't have a purpose-built debug util.
Sharpkeys is a step in the right direction, but
it's not feature-complete as a malware buster.

Apparently ETW has key character tracing capability,
but I'm unable to collect such events in Process Monitor,
and it's possible there's no handler for them. People
have even built keyloggers using ETW. But in that subsystem,
there is no ability to "interfere" with the stream, so
the backspace key would continue to work. Whereas a Filter
Driver allows both logging as well as making characters
disappear.

Part of the problem at times like this, is the OS is
entirely too flexible, and it's pretty hard to know
where all the attack surfaces are, and what the signs
of being attacked that way are.

Paul

Here's my Device Manager:

https://postimg.cc/DmCMYtkr

https://postimg.cc/pmjcrr9C

https://postimg.cc/5HqP5rSF


So because Microsoft is of no help and there's no trace of
when or where it happened or even a Mrimg we can restore
to before this all happened it looks as if I'm stuck with no
back space key function?

The only other option and there's no guarantee that it won't
make matters worst would be to rebuild the computer from
scratch. That's a tremendous amount of work and I'm not
sure I would want to risk it especially with the 8500.

However I am concerned it still has it's original hd with no
backup hd should it fail. I have the Mrimgs of course but I still
would like Win 7 Pro put on all the hd's I bought so that I have
backup hs's in place in case I need them.

I thought the backspace key problem would be a simple matter
and we could move on to cloning the hd's. I can still clone the
hd's and if you think of something we can always copy over them
correct? I'll keep checking back on this thread just in case you think
of something else we can try. How's that?

So should we start to clone the hd's for the 780 and 8500 or?



Thought/suggestions
Robert

I still think it extremely weird and uncommon that both computers
have the same exact problem.

As I've said, I barely use the 780, it's sole function is to serve as a
backup computer to the 8500. I have the bare minimum of programs
to use it and only run scans, updates, Mrimgs and that's about all.

It truly baffles me how both computers could have this problem.

Robert

The only thing we haven't tested is Sea Monkey. I was going to
but it wasn't listed in Programs and Features yet it's listed in
StartPrograms.

That's the only thing both computers have that I've added recently
and we've checked everything else. Is there some way of checking
Sea Monkey? Maybe some files are corrupted or something?

Robert

Robert in CA wrote:
Here's my Device Manager:

https://postimg.cc/DmCMYtkr

https://postimg.cc/pmjcrr9C

https://postimg.cc/5HqP5rSF


So because Microsoft is of no help and there's no trace of
when or where it happened or even a Mrimg we can restore
to before this all happened it looks as if I'm stuck with no
back space key function?

The only other option and there's no guarantee that it won't
make matters worst would be to rebuild the computer from
scratch. That's a tremendous amount of work and I'm not
sure I would want to risk it especially with the 8500.

However I am concerned it still has it's original hd with no
backup hd should it fail. I have the Mrimgs of course but I still
would like Win 7 Pro put on all the hd's I bought so that I have
backup hs's in place in case I need them.

I thought the backspace key problem would be a simple matter
and we could move on to cloning the hd's. I can still clone the
hd's and if you think of something we can always copy over them
correct? I'll keep checking back on this thread just in case you think
of something else we can try. How's that?

So should we start to clone the hd's for the 780 and 8500 or?

Thought/suggestions
Robert

In the Driver details, there's the "aswKbd.sys" of Avast.

Under the Details tab, you have to look at the Filter
entries, to see how many filter drivers are registered.
I would expect the Avast filter driver "aswKbd" would be
registered (depends on what name they gave it).

Does Avast have any keyboard preferences ?

*******

You could check in Programs and Features and see if there's a Mozilla
section. The trademark for Seamonkey could be owned by Mozilla. There
really should be an entry for it.

http://forums.mozillazine.org/viewtopic.php?p=10973303

Posted June 29th, 2011, 6:57 pm

Go into the SeaMonkey installation directory, [Program Files...]
then to the "Uninstall" subdirectory,
then double-click on "helper.exe".

That's for removal, if all else fails such as using the
control panel Programs and Features in Windows 7.

Paul