Sorry, can't think of a meaningful title for this one

[Binoculars]

It's like this. Suddenly I find that when composing posts, when I hit the Enter button to start a new paragraph, the title bar becomes inactive, and I have to click in the window to make it active again then use the arrow key to go down to where my new cursor should be. Another Enter produces the same effect again. I have taken to composing posts in Word where the same problem doesn't occur. It also happens when composing emails in my Pprune email account, so I am reduced to the same fix, but it doesn't happen in Outlook Express..

This apparently coincided with my changing my desktop appearance to a new scheme, but reverting to the standard Windows appearance now doesn't make any difference. I'm at a loss to understand what the connection may be, as I didn't change any options along the way.

Any ideas?

P.S. Celeron 900, W98SE

[Naples Air Center, Inc.]

Binoculars,

I have seen Spyware and Malware cause the problem you are describing. I would try a different keyboard for testing purposes, then if that is not the problem, I would do a repair of the OS.

Take Care,

Richard

[Binoculars]

Thanks Richard. I have run Spybot and Adaware, deleted all cookies, rebooted and no change. I also use Zone Alarm and EZTrust anti-virus fully updated. A different keyboard had the same result.

It's such an odd and specific problem it seems strange, but I notice Mywebsearch has placed its own toolbar on my screen and I can't find any way of getting rid of it. Don't know if that has anything to do with the problem; I would have thought Spybot or Adaware would have notified me of it. Or did one of those programs in fact put it there? Very mysterious.

Since I'm on 98SE and don't have a system restore available to me, I can assume you meant a clean reinstall by suggesting a repair to the OS? *Sigh* Maybe I'll just keep composing everything in Word.

[BOAC]

Binos - if you are feeling brave, you could search your registry for 'mywebsearch'? Best report back with any finds here for advice though before doing anything

[BEagle]

IIRC, that 'mywebsearch' thing was one of the peices of cr@p that used to come in with PPRuNe Pilot Mail - you had to be very careful not to click on 'yes' and it was often easier just to turn everything off than to interact with the $odding pop ups to get them to bug ger off

[Binoculars]

Hmmm, methinks this Mywebsearch is a nasty little piece of goods.

I run a nice little program call RegCleaner which till now has always had no trouble removing the remnants of no longer wanted programs that Add/Remove Programs leaves behind. I used it to clean out all remaining parts of Mywebsearch, rebooted, and bugga me if Mywebsearch toolbar still didn’t appear. Hmmm. Ran msconfig to look for startup files, sure enough, there is Mywebsearch; disabled it from startup files, rebooted and bugga me if the toolbar still didn’t reappear.

Hmmm. Check startup again, Mywebsearch is disabled, but toolbar still appears. Let’s try Add/Remove Programs.. sure enough, there is Mywebsearch with two files. Attempt to disable both. Nothing happens for five minutes! I wait. Eventually a page comes up assuring that Mywebsearch is the best thing ever to happen to the internet, it contains ABSOLUTELY NO SPYWARE OR ADWARE. It features PopSwatter and SmileyCentral amongst other indispensable things. Are you really sure you want to uninstall this magnificent program? Uninstall now. Or NO I DON'T WANT TO UNINSTALL I click on Uninstall now you bastards. And nothing happens! My computer goes dead! I wait and wait, and eventually concede defeat and reboot, and guess what toolbar smilingly greets me?

In the meantime I continue to compose in Word. The original problem has become secondary to getting rid of these Mywebsearch assholes.

All opinions welcome.

[Bern Oulli]

Binos, you might like to check out these two links:

http://www.free-web-browsers.com/sup...mysearch.shtml
http://www.onlinepcfix.com/spyware/s...OVMTC=standard

MyWebSearch (aka MySearch) seems to be spyware of the most pernicious kind. I've not suffered from it myself so I don't know whether these links will help.

Try also searching under "remove MyWebSearch". Thats how I found these.

Good luck

[E-Liam]

Hi Binos,

Please download 'Hijack This!' from here, unzip, and place it in it’s own folder, (not in the temp folder, or on the desktop) doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, click "Save Log", and copy and paste it in a PM to me.

Don’t fix anything yourself yet, as a lot of the stuff on that list will be harmless or required.

I get rid of it on a regular basis, it just has to be done in the right order.

Cheers

Liam

---------------------------------------------------------------------------------
A member of the Alliance of Security Analysis Professionals since 2004.

[Binoculars]

Thanks Liam, on its way.

Wait a minute, the Mywebsearch toolbar has gone..?

[SoftTop]

Also make sure your copies of AdAware and Spybot are up to date.

Check the configuration of each and make sure you're looking for EVERYTHING!!! Trying to save a few minutes worth of scanning by deselecting some of the more esoteric options ain't worth it.

Have fun

[Naples Air Center, Inc.]

Binoculars,

I would go the Fresh Install from the CABs route. It will solve the problem and speed up your computer for you.

Take Care,

Richard

[OzPax1]

I got this little ****** too. Followed the instuctions above (also researched it via google too) on how too remove it. Invasive bu**er isn't it. How it got onto my machine I do not know as my work background is similar to Richard's, so I am more aware of things like this then most!!!

[Binoculars]

Curiouser and curiouser. Thanks to all who responded and special thanks to E-Liam who PM'ed me a tremendously detailed and foolproof list of instructions for getting rid of this thing called CoolWebSearch, which is indeed a nasty little bugga involving a trojan which as I understand it apparently gets into computers still running an early version of Microsoft Java. I imagine from this that XP would be safe, but I may be wrong there. Anyway, all traces of it have now been removed from my computer, for which I am very grateful.

HOWEVER! My original problem still remains. While trying to compose a message on a web based email, (it happens on Pprune email, Hotmail, and Excite Mail), a post on Pprune and I assume other noticeboards, or even a PM on Pprune, the Enter key still makes the screen inactive; the cursor disappears and I have to click in the frame for it to reappear then use arrow keys to move it to where I want it to go. If I wanted to hit Enter ten times I would have to repeat this process ten times.

Anybody else found this problem?

[E-Liam]

Hi Binos,
I just checked through the log again.. (I'd forgotten your original reason for posting..)

Boot to safe mode, and search for and delete these files...

sysie.dll
systemie.dll
systemie.dat
systemie.exe

...It's a keylogger. Only the .exe file shows on the log, and I didn't pick up on it as I wasn't looking for it.

Then download and run the free version of TDS3 , check for updates and run it. Just to make sure there are no other nasties lurking.

Finally, and most importantly, change all passwords and especially anything concerned with online banking, shopping etc. where you've entered a card No.

Cheers

Liam

---------------------------------------------------------------------------------
A member of the Alliance of Security Analysis Professionals since 2004.

[Ausatco]

E-liam,

A question if I may ... all my logons, passwords, personal details, credit card numbers, etc are now entered when necessary by software (Roboform). It keeps a record for, and knows each site you want it to remember and offers the info when appropriate. It's all point and click with the mouse, most times one click to log on to a site - no keystrokes. Similarly, one click to fill in on-line bill-paying data such as account number, credit card number, expiry date etc, no keystrokes.

Can a keylogger see any of that? I'm thinking "no", but I'd like to be reassured.

Thanks

AA

PS
For those curious about Roboform, all personal data for each recorded site is encrypted and stored locally within Roboform. All sensitive data may be further protected, at user option, with a master password. Without the master password, if someone stole your lappy, for example, they could log on to, say, your internet banking account because the logon name and password is automatically supplied when your banking page comes up. Activate the master password function and that won't happen because the logon info is not supplied until the master password is entered. I like it.

[Binoculars]

E-LIAM, You're a champion!

I'm madly pushing the enter button and the cursor is going down and down! Woohoooo!!!

Thanks mate, I owe you a big drink.

Cheers,

Binos

[E-Liam]

Hi AA,

I've just been checking and yes, you should be fine... BUT if you had the keylogger on your machine when you filled in the passcards then they've already got the info. Of course as with anything on your machine, the info can only get out if allowed. A decent firewall carefully set up should stop the info leaving your machine in the first place.

Cheers

Liam

Binos,

Glad to hear it..

And you\'re welcome. Just a shame I didn\'t notice it the first time around..

Cheers

Liam

EDIT: Darned reediting gizmo... this is meant to be two separate posts.

[Ausatco]

Thanks for the reassurance, Liam. I'm satisfied that the machines were clean when I installed Roboform, so all should be ok. Firewall in the router, and Zonealarm Plus and PCCillin on each machine, so hopefully fairly well protected. One can't be too careful, though.

I don't like the re-editing gizmo much either - it caught me out last night in the same way.

Cheers

AA