i would definately leave it in quarantine for a while,  not sure what you mean by 'deny access' though as i dont use avira. whilst it is quarantined you are protected from it. if it means deny access to the internet, then yes, deny it access.

some keyloggers are part of "legitimate" parental control programs, but most are info stealers (credit card info etc) so definately deny it access to the internet.

Dale,

"DR/KeyLogger.DQ.2" is the type ("classification" ) of problem allegedly located... but there should be more information there, such as the filename of the "infected" file, or the specific registry key "infected".   did you see any more information there?

we need to determine if this is a legitimate threat, or a false positive.   in any event, until a definitive determination is made, be very careful what information you type into that PC... if a true keylogger, everything you type (credit card #, social security #, bank account #s --- or even your e-mail accounts or DELL login password) --- is subject to being "stolen" from you.

I'm not sure what other program looks specifically for keyloggers... i think SpyBot does... see if it reports anything...

Thanks Guys:

A Spybot scan came up clean, but I will run the AntiVir again a bit later and see if I can glean any more info about what exactly is going on with this thing. If I remember correctly, the AntiVir alert screen came with the Quarantine box preselected...not being quite sure what to do I hit OK. Then another alert came up with the Deny Access box selected. So I hit OK in that case also. A bit later in the scan the whole sequence came up again. I will also run scans in the next day or so with MBAM, AGV AntiVirus, and Windows Defender to see if they pick anything up.

For the time being I will visit by bank's website on my spare computer....after running a few scans of course. :smileywink: Will something like this show up on a HJT log?

Dale,

if you hit "okay" to Quarantine the item... can't you simply check antivir's quarantine area to see what's in there, and get the information?

keyloggers might show up in an HJT log, if they auto-start through "normal" means.   but if it (conceivably) "hides" itself somehow, then it may not show.   you certainly can't lose anything by generating/posting a log.   but if you can locate more info, i think that would be helpful.   [for example, if it names the specific file, we can try to check it out... and upload it to Jotti &etc. for analysis.]

Well...a AntiVir scan a short time ago did not find those files again. :smileyvery-happy: It does give a warning each time that the hiberfil.sys and pagefile.sys could not be opened...I am not sure why this is displayed each scan...guess it comes with the scan process. I went back and checked into where these showed up and it was in two locations:

C:\Documents and Settings\Dale\Desktop\Odds & Ends\sdsetup.exe. 

Odds & Ends is what I named the download folder. This file apparently has something to do with Spyware Doctor, but I have not used that program for some time now.

And it also appeared here:

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1177\A0246723.exe.

The only thing I have done since yesterday is my regular morning update search. They malware files both ended up in quarantine, so I don't know if hitting the Deny Access button when an alert was offered for each item...in addition to accepting the quarantine option...has kept them from getting into my system again.

Since [as I'm understanding things] those two files are now in quarantine, you're certainly "safe".   However, I seriously doubt that SDSetup --- which would appear to be the setup/installation file for Spyware Doctor --- is itself a keylogger.   Rather, it's more likely that Spyware Doctor's database of malware includes information on that keylogger, in order for Spyware Doctor to detect it, and that this "signature" triggered a F/P reaction by AntiVir.  The other file was created by System Restore, which might have created a restore point when you installed Spyware Doctor, containing the same "signature".

I'd suggest you report these findings at the antivir forum, and monitor it to see if they --- or other users --- confirm this as a false positive.