Posible virus (keyboard and mouse cursor delay)

Yasterday I start to have problems with the keyboard and the mouse cursor.
The keyboard feedback is very slow so I have to type very slow in order that
all the letter and spaces type correctly (forexmape ths pararga is typed
atnora sped) and the mouse cursor displacement is paused. That is anoying, I
scan the computer but no virus was found (the antivirus is up to date) then I
restore the system to another date and fix the problem, but today the problem
persist.
I download the malware removal tool but no malware is found.
Some one have the same problem or have a suggestion?
Thanks

Annoyed Man74 wrote:

> Yasterday I start to have problems with the keyboard and the mouse
> cursor. The keyboard feedback is very slow so I have to type very slow
> in order that all the letter and spaces type correctly (forexmape ths
> pararga is typed atnora sped) and the mouse cursor displacement is
> paused. That is anoying, I scan the computer but no virus was found
> (the antivirus is up to date) then I restore the system to another
> date and fix the problem, but today the problem persist.
> I download the malware removal tool but no malware is found.
> Some one have the same problem or have a suggestion?
> Thanks

1. Look in the Accessibility Options applet in Control Panel. Do you
have Slow Keys toggled on? If you do, turn it off.

2. If #1 isn't applicable, open Task Manager and see what is taking up
the cpu cycles. You can also download Sysinternals' Process Explorer
for a thorough picture of what's running.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

"Malke" wrote:

> 1. Look in the Accessibility Options applet in Control Panel. Do you
> have Slow Keys toggled on? If you do, turn it off.
>
> 2. If #1 isn't applicable, open Task Manager and see what is taking up
> the cpu cycles. You can also download Sysinternals' Process Explorer
> for a thorough picture of what's running.
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>
Malke

Thank you for the suggestions, I try with the #1 but when I click the
accesibility options appears the message "windows can't find the file
accwiz.exe"

the #2 I realy don't know what means this

Thank you

Annoyed Man74 wrote:

>
>
> "Malke" wrote:
>
>> 1. Look in the Accessibility Options applet in Control Panel. Do you
>> have Slow Keys toggled on? If you do, turn it off.
>>
>> 2. If #1 isn't applicable, open Task Manager and see what is taking
>> up the cpu cycles. You can also download Sysinternals' Process
>> Explorer for a thorough picture of what's running.
>>
>> Malke
>> --
>> Elephant Boy Computers
>> www.elephantboycomputers.com
>> "Don't Panic!"
>> MS-MVP Windows - Shell/User
>>
> Malke
>
> Thank you for the suggestions, I try with the #1 but when I click the
> accesibility options appears the message "windows can't find the file
> accwiz.exe"
>
> the #2 I realy don't know what means this
>

If you can't open a Control Panel applet, then your computer is
definitely having problems. You weren't specific about what
virus/scanning tools you used. Here are my general malware removal
steps:

http://www.elephantboycomputers.com/...moving_Malware

Review them and if you didn't use any of those tools or do any of the
typical prep work I outline, and/or didn't scan in Safe Mode then
please do so.

My #2 item is meant to find out what process is taking over. It does
require that you know what you're looking at. I mean no disrespect by
saying this - I have no idea what your skill level is and I'm not
saying this to hurt your feelings. But if you don't know what you're
looking at or how to determine what is taking the cpu cycles, consider
taking the machine to a professional computer repair shop/person (not
your local version of BigStoreUSA). There is no shame in doing this; we
all have our areas of expertise.

Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Mr. Man74,

In addition to the great advice that Malke gave, I would like to add the
following. From what I have read, a "rootkit" can infect a computer and
"control" something called IRQs. If a rootkit is installed, it can operate at
the "kernel" level. Since the "kernel" level is lower than the "user" level,
the rootkit can hide its activity from virus scans and malware detectors.
Once it hides, it can do just about anything that a programmers designs it to
do.

With the above stated, I must say that most experts-rootkit
developers-suggest that an average person, including people with average
knowledge in OS security, do a complete wipe of their drive and perform a
re-install.

The problem with system restore is that it saves current data when creating
a restore point. As such, if the "rootkit" data is on before the most recent
restore point is created, the rootkit/virus/malware will be included with the
new restore point.

In addition to the above, you can also modify your "Local Security Policy"
so that "unsigned drivers" can not be installed w/o Administrator approval.
If you would like info on local security policy, I suggest the following:
Click Start---->control panel--->Performance and
Maintenance--->Administrative Tools--->Local Security Policy---Select Help
from tool bar----> type in the question

One example is a keylogger: Each time you strike a key on the KB, an
electrical signal is sent so that the computer can determine what key was
pressed. Code is then used to display that information of the screen. I am
not an expert, but I suppose one could write a program to delay one keystroke
and speed the delivery of another.

Also, I believe interupts are hidden as "Idle time". As such, one may notice
an increase in "idle" time if using task manager. The problem is that most
users, myself included, may not know what the usual "Idle Time CPU usuage" is
suppose to be. There are some tools that graph out these times.

If you want to learn about a built in tool, open "Help and Support" and type
"performance monitor" in the text box and follow the instructions.


"Annoyed Man74" wrote:

> Yasterday I start to have problems with the keyboard and the mouse cursor.
> The keyboard feedback is very slow so I have to type very slow in order that
> all the letter and spaces type correctly (forexmape ths pararga is typed
> atnora sped) and the mouse cursor displacement is paused. That is anoying, I
> scan the computer but no virus was found (the antivirus is up to date) then I
> restore the system to another date and fix the problem, but today the problem
> persist.
> I download the malware removal tool but no malware is found.
> Some one have the same problem or have a suggestion?
> Thanks

QuidnuncSimcha wrote:
> Mr. Man74,
>
> In addition to the great advice that Malke gave, I would like to add the
> following. From what I have read, a "rootkit" can infect a computer and
> "control" something called IRQs. If a rootkit is installed, it can operate at
> the "kernel" level. Since the "kernel" level is lower than the "user" level,
> the rootkit can hide its activity from virus scans and malware detectors.
> Once it hides, it can do just about anything that a programmers designs it to
> do.
>
> With the above stated, I must say that most experts-rootkit
> developers-suggest that an average person, including people with average
> knowledge in OS security, do a complete wipe of their drive and perform a
> re-install.
>
> The problem with system restore is that it saves current data when creating
> a restore point. As such, if the "rootkit" data is on before the most recent
> restore point is created, the rootkit/virus/malware will be included with the
> new restore point.
>

There is a list of anti rootkit programs at
http://www.antirootkit.com/software/index.htm
Try a few of them to be sure. Sophos have just released a new anti
rootkit program and it is reported to be very good,

Z

Zoned,

Personally, I am very weary of sites that have "freeware".

As you probably know, rootkit developers are an intelligent bunch who love
to "tinker" with systems and "exploit" code. As such, the "more curious" of
the bunch will figure out a way to exploit rootkit detectors. Especially the
free versions.



"Zoned" wrote:

>
> QuidnuncSimcha wrote:
> > Mr. Man74,
> >
> > In addition to the great advice that Malke gave, I would like to add the
> > following. From what I have read, a "rootkit" can infect a computer and
> > "control" something called IRQs. If a rootkit is installed, it can operate at
> > the "kernel" level. Since the "kernel" level is lower than the "user" level,
> > the rootkit can hide its activity from virus scans and malware detectors.
> > Once it hides, it can do just about anything that a programmers designs it to
> > do.
> >
> > With the above stated, I must say that most experts-rootkit
> > developers-suggest that an average person, including people with average
> > knowledge in OS security, do a complete wipe of their drive and perform a
> > re-install.
> >
> > The problem with system restore is that it saves current data when creating
> > a restore point. As such, if the "rootkit" data is on before the most recent
> > restore point is created, the rootkit/virus/malware will be included with the
> > new restore point.
> >
>
> There is a list of anti rootkit programs at
> http://www.antirootkit.com/software/index.htm
> Try a few of them to be sure. Sophos have just released a new anti
> rootkit program and it is reported to be very good,
>
> Z
>
>

Malke

Thank you for your advise, and don't worry about to hurt my feelings, I am
an average guy that know the basics of computers so I have my limits.

First, I have norton antivirus 2006, I update the virus definitions today
and run full scan and no virus found appear, also I download windows malware
removal tool and nothing happen.

Second, I open task manager and I see various process alternatig the CPU
cycles, but the names means nothing to me (ie. lsass.exe)

This problem aparently is innofensive, but I think that the best is to fin
help with a profesional tecnician.

Thank a lot


"Malke" wrote:

> If you can't open a Control Panel applet, then your computer is
> definitely having problems. You weren't specific about what
> virus/scanning tools you used. Here are my general malware removal
> steps:
>
> http://www.elephantboycomputers.com/...moving_Malware
>
> Review them and if you didn't use any of those tools or do any of the
> typical prep work I outline, and/or didn't scan in Safe Mode then
> please do so.
>
> My #2 item is meant to find out what process is taking over. It does
> require that you know what you're looking at. I mean no disrespect by
> saying this - I have no idea what your skill level is and I'm not
> saying this to hurt your feelings. But if you don't know what you're
> looking at or how to determine what is taking the cpu cycles, consider
> taking the machine to a professional computer repair shop/person (not
> your local version of BigStoreUSA). There is no shame in doing this; we
> all have our areas of expertise.
>
> Malke
> --
> Elephant Boy Computers
> www.elephantboycomputers.com
> "Don't Panic!"
> MS-MVP Windows - Shell/User
>