Expert: Brian Benosky - 3/21/2011

Question
QUESTION: Hi, my keyboard is behaving erratic. The Alt key is perpetually in a pressed mode though it is not. This makes me have to press the alt key each time i type a sentence.
Is it a malware?

HJT log is as follows:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:20:59 PM, on 3/15/2011
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\as\Application Data\Dropbox\bin\Dropbox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Desktop\HijackThis.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Desktop\mh73xoeb.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\as\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\as\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Dropbox.lnk = C:\Documents and Settings\as\Application Data\Dropbox\bin\Dropbox.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{46E2D949-E015-4C0C-B090-6F435828EDF7}: NameServer = 172.16.13.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{B1273121-4C48-443F-900F-D06EC6636F3E}: NameServer = 172.16.13.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

--
End of file - 4004 bytes

ANSWER: Hi Manish

Your log file looks good, so I will venture to say that the problem is not malware related.  More likely, this is a hardware issue.  Keyboards, especially wired ones, do fail.  Try borrowing another keyboard and connect it to your computer to determine if this is indeed the case.  If not, let me know and we will dig a bit deeper to find the trouble.

Brian

---------- FOLLOW-UP ----------

QUESTION: Thanks Brian
But the problem is that at times, it works normally while during other times, its erratic. more ever, in the command prompt, i dont find problems. its mainly while using windows and the browsers.
Can you kindly share your thoughts on this?

Thanks
Manish

Answer
Hi Manish

You do not say if you have tried another keyboard, as I recommended.  If so, and the problem is persisting, see if the problem occurs in Safe Mode.  If you are unsure how to boot into Safe Mode, see this link:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/b

Brian