Greetings.
Please forgive me. I have not learned to speak meaningfully in short bytes yet. I use Avast Standard updated, Kerio 4 firewall and have XP Home.
I have always used Ad Aware but recently it freezes so ran Spybot (updated) the other night which found
Retrieve. C:\Windows\access.exe
but could not remove it even after reboot.
I searched on Google and found a fix at www.hackfix.org/miscfix/retrieve.shtml
(but this has disappeared from Google now…???)
Here’s what the page said:
Retrieve v1.3
Translator
(Updated Aug 30th, 1999)
This program gets and unencrypts passwords from applications to send back to its installer.
The apps it trys to get passwords from are the following:
Removal
Next Click Start, and go to Run. In the box, type regedit and click OK.
When regedit starts, you will see a file-like tree on the left hand panel. Open the folders to follow the path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Click on ‘Run’ and the righthand panel will change. Look for the item titled: Microsoft Access =“C:\WINDOWS\access.exe”
Right click on ‘Microsoft Access’ and choose Delete.
Close regedit
Next reboot your computer.
When windows restarts, open Windows explorer, and in the directory C:\Windows\ find and delete the file access.exe.
Your now disinfected!
My question is, will this work? Is it safe for a simpleton such as I to try to edit the registry?
Does anyone know an easier/safer way to remove this keylogger?
How dangerous is it? I see no evidence of its work but it may have been on the computer for up to three years if none of my spycatchers/ anti-virus/ firewall could actually find it. I use no online financial services nor any or the services (above) pertaining to the keylogger altho’ I am on dial-up.
Thank you in advance for any help you may be able to give. Please explain anything as if you were speaking to a five year old, as I am still learning computer-speak.
Thank you Eddy.
Another speedy reply from you!
I have downloaded HJT from the link you provided but have never used HJT before. I will read about how to use it and post the log tomorrow (as long as I can work it out).
My brain is soup right now so I will rest and hopefully catch up with you in about 12 hours when I can get back here.
Really appreciate your help!
tired but grateful kakapo
Well, after reading two webpages about HJT I thought I could manage it but instead I got an error message:
“Error writing temp file. Make sure your temp folder is valid”
I don’t know how to do that sorry.
Hope someone can help me.
Thank you.
kakapo
Are you using the one that comes with my analyzer? If not, get that one so we at least know it is a good one. If you don’t have that one, you can get it from HERE.
I will install in C:\Program Files\HJTanalyzer (unless you specify another folder). After installing browse to that folder and try to run HijackThis.exe
I downloaded it from the page in your signature Eddy. I’m just doing so again and will try to run it. I saved it to my documents. Maybe I should save it to my desktop??
Thank you for your patience.
kakapo
I can’t get HJT to work at all Eddy even after d/ling from both sites. Same error.
I am a little nervous of Safe Mode as last time I went there I couldn’t get OUT again. Computer got “stuck” in there and would only reboot in safe Mode. I cannot remember how I resolved this now…
Something’s maybe wrong with the temp folder (I guess) so will search for answers to this.
I am a writer and have a deadline today so will get back to you if I have luck finding solutions after I write today’s story.
Many thanks for your help.
kakapo
But back to the problem, it seems to me that your installation of Windows is really messed up. It is my opinion you need to do at least a repair installation and perhaps even are facing a clean installation to solve the problem.