avast! not detected Beyond Keylogger

Viruses and worms
1

avast! does not detect the keylogger “Beyond Keylogger”. As there is a problem when sending BlazingTools Perfect Keylogger to chest or deleting it.

Beyond Keylogger from: wXw.supremtec.com
Blazingtools Perfect Keylogger from: wXw.blazingtools.com

There are also malicious pages that are not blocked by the network shield as wXw.seriall.com and many others malicious web sites

2

Send the sample in a password protected zip/rar folder to virus@avast.com with the undetected malware in subject and the password mentioned in the email body.

You should also use Firefox with NoScript, Adblock Plus, and Keyscrambler.

I suggest you use MBAM or SuperAntiSpyware Free. Be warned, everything you type gets spied on.

Also please remove the links by replacing http with hxxp.

3

Hi Llanziel,

Your link to: wXw.seriall.com/
is flagged here: http://www.siteadvisor.com/sites/www.seriall.com/
While unmasked parasites by Google gives it as clean…
Wepawet also gives as benign…
http://wepawet.iseclab.org/view.php?hash=d3f76d9896e1343ed8d817579486d14b&t=1255443991&type=js

Sites like these are better be shunned, because of the material found thereon,
it could contain unwanted software downloads.

I would not like to advice to visit this sort of site anyways,

Beyond Keylogger manual removal instructions:
Kill processes:
csrss.exe, emconv.exe

Delete registry values:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\csrss=C:\Program Files\Supremtec\csrss.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss=C:\Program Files\Supremtec\csrss.exe
HKEY_LOCAL_MACHINE\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Beyond Keylogger 1.5_is1

Delete files:
csrss.exe, emconv.exe, rgtcvc32.dll, unins000.exe, uninshs.exe

Delete directories:
C:\Program Files\Supremtec
Misc:
Exact file location:
emconv.exe, rgtcvc32.exe - C:\Windows\System32 or C:\Winnt\System32
other files - C:\Program Files\Supremtec
More information about Beyond Keylogger can be found on the official site: www.supremtec.com

Some av-solutions consider these programs risktools when they are not installed by the user,

polonus

4

Thanks for his recommendations polonus and jtaylor83. But it is not that I am infected by the spyware. For time (almost 3 months) I send the program to virus@avast, but up to today keep on being invisible before avast! you do not imagine all the times I have sent the results. But the one that more worries me is the way in which avast acts under Blazintools Perfect Keylogger. It is a little complicated to remove the last one. The only way is erasing the temp files. Since avast it cannot eliminate them, and I would like that someone explains to me because of the error: “The action is not supported for this type of archive”.

Also avast! not detect the fake anti-malware “adwarealert” from www.adwarealert.com

Note: Windows Defender detect it as unwanted software after two or three day of installation, but I not remember the infection name because some time ago of this incident.

5

I already send the archive (Beyond Keylogger and Adwarealert) to virus@avast through avast chest since last week, but still undetected.

is avast chest emailing service working properly?

6

You can use conventional method to sent malware sample to alwil
using regular e-mail services like yahoo, msn or whatever e-mail service you have
before you sent, password compressed file the sample
sent to virus@avast and attach the malware sample and sent

i sent undetected malware to avast using viruschest way and 3 days still not detected.
so, i use yahoo and mail the sample to avast and they are finally detected.

7

Hi,

Based on Norton Safe Web this xxx.adwarealert.com was infected by Malware Bot

adwarealert.com
Summary
•Computer Threats:
1
•Identity Threats:
0
•Annoyance factors:

0

Total threats on this site:
1

Threats found: 1
Here is a complete list:
Threat Name: MalwareBot
Location: http://get.adwarealert.com/setupxv.exe

Web Site Location United States of America

Hopefully avast virus team could generated a new VPS definition as soonest as possible.

Regards,
Yanto Chiang

8

Dear All,

To prevent this i just got information from one of avast evangelist, you can download and install : Browser Defender

This is more informative to prevent user from unknown download.

Regards,
Yanto Chiang