Protexis.MOD

[dooleda]

Spybot detected Protexis.MOD on my computer. I let Spybot fix it, but can someone give me any more details about this keylogger? Where does it come from? What does it do besides capture keystrokes ( I assume for banking websites, etc)? How can I tell if it got anything off my computer?

[seekaybee]

I have no idea but I second your question. The directories in question -- C:\ProgramData\Protexis , C:\ProgramData\Protexis\DL and C:\ProgramData\Protexis\State -- were all empty. A Google search returned only a small number of hits -- none very enlightening.

[vsparky]

I have no idea but I second your question. The directories in question -- C:\ProgramData\Protexis , C:\ProgramData\Protexis\DL and C:\ProgramData\Protexis\State -- were all empty. A Google search returned only a small number of hits -- none very enlightening.

me too ...exactly

anyone?

[honda12]

hmm this may just be a coincidence, but spybot just happened to detect the same keylogger today when I scanned!

Merry Christmas

[tashi]

As the topic is getting longer, I have moved it to the false positives forum (just in case), and will bring to the attention of a detective.

[Yodama]

hello,

it appears that Protexis is the publisher of the qwertystudio MOD Keylogger while qwertystudio is the actual vendor. Since it is safe to assume that Protexis also publishes other software we will consider the Protexis folders as false positives. The Keylogger will also be renamed to Qwertystudio.MOD . This will take effect with the update scheduled for next wednesday .

[dooleda]

There was actually a file in the Protexis folder on my computer before Spybot removed it. The file looked like it had a randomly generated number for a name with a .plf extension. Would this make any difference as far as actually being malware or not?

Does anyone know what the keyloggers from each vendor log? Does someone know if this file came from the publisher Protexis or qwertystudio? Sorry about so many questions, but I would like to know as much as possible about this file since it was found on my computer. I'd like to know what it did or what it possibly could do because I didn't install anything from Protexis or qwertystudio unless it came bundled with something else.

Thanks for any help.

[Yodama]

There was actually a file in the Protexis folder on my computer before Spybot removed it. The file looked like it had a randomly generated number for a name with a .plf extension. Would this make any difference as far as actually being malware or not?

This file does not appear to be harmful, the Protexis folder appear to be created with all softwares which get promoted/published by Protexis (making it some kind of bundling).

The QwertyStudio.MOD Keylogger only loggs keystrokes, it does not appear to have advanced features like making screenshots.

You most likely have a software installed that was promoted/published via Protexis, if you are unsure if there may be some harmful software involved you can create a Spybot S&D or Runalyzer log and sent it do us for analysis.

[darkblitz]

Well.. spybot has been catching it alot of times. So i made a runanalyzer log.
Please check it out.

HIJ is attached

[Needlenose]

Spybot detected this virus on my computer as well...