Home Malware Programs Keyloggers PDM.Keylogger

PDM.Keylogger

Posted: June 27, 2011

PDM.Keylogger can be a genuine keylogger and a threat to your computer, a false positive that's created by legitimate security software or a false positive that's creating by rogue security programs. Identifying which type of PDM.Keylogger problem you have requires that you take into account which type of program is providing the PDM.Keylogger alert. A real PDM.Keylogger keylogger can steal passwords and other sensitive information, but a false positive from real security programs is harmless. On the other hand, a rogue security program that creates PDM.Keylogger warnings may also block programs, hijack your browser or attempt to steal your financial information.

The Two Fake PDM.Keylogger Infections to Be Concerned With

PDM.Keylogger has been seen as a false positive (or nonexistent and inaccurate threat detection) by both legitimate and illegitimate security programs. Because of this, it's important to be sure that you're using trustworthy security software before you take action with regards to any PDM.Keylogger infection warning.

With regards to genuinely mistaken threat alerts, PDM.Keylogger warnings are often triggered by certain keyboard drivers, by the natural Windows object that's known as 'Process (PID: 0): kernel mode memory patch,' and by certain video and audio codecs. You should check to see if your chosen anti-virus scanner has a history of false positives with these objects; if so, you can add the objects to an exceptions list and have the program ignore it from henceforth.

Then again, you may not want to dismiss a PDM.Keylogger warning completely, either. Some rogue security programs like Dr. Guard, Paladin Antivirus, and Malware Defense will also use PDM.Keylogger alerts. The text of these alerts may resemble the following example:

Warning! Keylogger detected!
Kelloger [sic] activity detected on your PC!
PDM.Keylogger activity has been detected. Process is trying to redirect keyboard input. Your passwords and other private information are at risk. Please click the button below to block and remove
this threat now.

By itself, this message isn't harmful to your PC and doesn't imply that there's a real PDM.Keylogger infection lurking on your hard drive. However, rogue security programs such as the ones listed above may attempt a variety of harmful actions, including theft of credit card information or money, hijacking your browser, launching themselves without permission and blocking programs.

Rogue security programs that use PDM.Keylogger alerts should be ignored and deleted, just like you'd delete a real PDM.Keylogger threat.

The Real Possibility of a PDM.Keylogger Assault

In some cases, PDM.Keylogger can also be a real keylogger. Keyloggers are dangerous for their ability to record keyboard keystrokes for the sake of stealing passwords and other private data. If you think you have a real PDM.Keylogger infection, you should assume that PDM.Keylogger is active and that all data potentially is compromised until you've secured your PC from the PDM.Keylogger threat.

Spyware like PDM.Keylogger will avoid obvious signals that would give away their presence, but most keyloggers will open ports or add exceptions to your firewall. PDM.Keylogger may also tamper with the Windows Registry or block certain programs.

In all cases of an actual PDM.Keylogger infection, you should remove PDM.Keylogger, not by trying to delete PDM.Keylogger by yourself, but by deleting PDM.Keylogger with an anti-virus scanner.

File System Modifications

  • The following files were created in the system:
    # File Name
    1 %Documents and Settings%\All Users\Application Data\fiosejgfse.dll
    2 %Program Files\Data Protection\about.ico
    3 %Program Files\Data Protection\activate.ico
    4 %Program Files\Data Protection\buy.ico
    5 %Program Files\Data Protection\dat.db
    6 %Program Files\Data Protection\datext.dll
    7 %Program Files\Data Protection\dathook.dll
    8 %Program Files\Data Protection\datprot.exe
    9 %Program Files\Data Protection\help.ico
    10 %Program Files\Data Protection\scan.ico
    11 %Program Files\Data Protection\settings.ico
    12 %Program Files\Data Protection\splash.mp3
    13 %Program Files\Data Protection\Uninstall.exe
    14 %Program Files\Data Protection\update.ico
    15 %Program Files\Data Protection\virus.mp3
    16 %Temp%\4otjesjty.mof
    17 %Temp%\MSWINSCK.exe
    18 %UserProfile%\Desktop\Data Protection.lnk
    19 %UserProfile%\Desktop\spam001.exe
    20 %UserProfile%\Desktop\spam002.exe
    21 %UserProfile%\Desktop\spam003.exe
    22 %UserProfile%\Desktop\troj000.exe
    23 %UserProfile%\Start Menu\Programs\Data Protection
    24 %UserProfile%\Start Menu\Programs\Data Protection\About.lnk
    25 %UserProfile%\Start Menu\Programs\Data Protection\Activate.lnk
    26 %UserProfile%\Start Menu\Programs\Data Protection\Buy.lnk
    27 %UserProfile%\Start Menu\Programs\Data Protection\Data Protection Support.lnk
    28 %UserProfile%\Start Menu\Programs\Data Protection\Data Protection.lnk
    29 %UserProfile%\Start Menu\Programs\Data Protection\Scan.lnk
    30 %Userprofile%\Start Menu\Programs\Data Protection\Settings.lnk
    31 %UserProfile%\Start Menu\Programs\Data Protection\Update.lnk

Registry Modifications

  • The following newly produced Registry Values are:
    HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\System "DisableTaskMgr" = "1"HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run "Data Protection"HKEY_LOCAL_MACHINE\SOFTWARE\Data ProtectionHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Shell Extensions\Approved "{5E2121EE-0300-11D4-8D3B-444553540000}"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\Uninstall\Data ProtectionHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Current Version\policies\system "DisableTaskMgr" = "1"HKEY..\..\..\..{RegistryKeys}HKEY_CLASSES_ROOT\CLSID\{5E2121EE-0300-11D4-8D3B-444553540000}
Loading...