Chat Watch spyware - how to delete?

Using Spyware Terminator for the first time today, I found installed on my 
computer Chat Watch (keylogger), which monitors my computer and sends reports 
somewhere.
It is located on my Desktop, in a folder called "Drive Backup Files.
When Spyware Terminator does an analysis, it says:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave 
MRU\*\gC:\aslframe.data.exe


HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave 
MRU\exe\gC:\aslframe.data.exe

How do I delete this?

morningglory wrote:

> Using Spyware Terminator for the first time today, I found installed on my

> computer Chat Watch (keylogger), which monitors my computer and sends
reports 
> somewhere.
> It is located on my Desktop, in a folder called "Drive Backup Files.
> When Spyware Terminator does an analysis, it says:
> 
> HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave

> MRU\*\gC:\aslframe.data.exe
> 
> HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave

> MRU\exe\gC:\aslframe.data.exe
> 
> How do I delete this?
> 
> Spybot did not find this software.

Entries in MRUs (most recently used lists) do not mean the file is still
on your hard drive.  After all, you have a history of web sites that you
have visited but that doesn't mean that you are currently connected to
them.  MRUs are a history.  You'll have to check if you actually have
the file on your hard drive.  If Spyware Terminator were any good, it
wouldn't be raising false alarms about entries in MRUs and instead would
alert when it found the malware's file.

False alarms are the lifeblood of rogueware.  They scare the
unsuspecting dupes into buying their crapware.

http://www.spywarewarrior.com/rogue_anti-spyware.htm

How many OTHER anti-malware programs did you try?  

Lavasoft Ad-Aware
Grisoft AVG AntiSpyware

Chat Watch is a commercial application. I'm not saying its good, just 
that it's not malware. How you got it is a mystery.


Chat Watch

http://www.snapfiles.com/reviews/Chat_Watch/chatwatch.html

Monitor AOL, MSN, ICQ and Yahoo chats

Our Rating:  (Excellent)

Chat Watch allows you to monitor complete chat conversations
made with ICQ, AOL Instant Messenger, MSN Messenger, Odigo,
Cheeta Chat and Yahoo Messenger. It records all messages sent
and all messages received and can optionally run completely
hidden from the user. The password protected interface provides
an easy to understand overview of all chats that have taken
place and you can review each in its entirety. Additional
features include an option to disable access to these chat
applications (Parental Control), monitoring for objectionable
content, logging to a network location,MSN 6 support, DeadAIM
support and automatic log e-mailing. You can also print chats,
email them, search them for specific text and more. Easy to use
and effective.

Chat Watch Publisher: Zemerick Software, Inc.
File Size: 3172 kb
Version: 5.0.0.9
Last updated: Apr 01, 2008
License: Free Trial, $29.95
Windows: Win (All)
Requirements: .NET Framework 2.0
Trial Limitations: 30 day trial. Some features disabled.

ju.c


"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message 
news:ONaLRNfmIHA.5684@TK2MSFTNGP03.phx.gbl...
> Unexplained computer behavior may be caused by deceptive software
> http://support.microsoft.com/kb/827315
>
> Run a /thorough/ check for hijackware, including posting your 
> hijackthis log to an appropriate forum.
>
> Checking for/Help with Hijackware
> http://aumha.org/a/parasite.htm
>   http://aumha.org/a/quickfix.htm
>   http://aumha.net/viewtopic.php?t=5878
> http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
> http://mvps.org/winhelp2002/unwanted.htm
> http://inetexplorer.mvps.org/data/prevention.htm
>   http://inetexplorer.mvps.org/tshoot.html
> http://www.mvps.org/sramesh2k/Malware_Defence.htm
> http://defendingyourmachine2.blogspot.com/
> http://www.elephantboycomputers.com/page2.html#Removing_Malware
>
> When all else fails, HijackThis v2.0.2
> (http://aumha.org/downloads/hijackthis.exe) is the preferred tool to 
> use. It will help you to both identify and remove any 
> hijackware/spyware with assistance from an expert.  **Post your log to 
> http://forums.spybot.info/forumdisplay.php?f=22, 
> http://castlecops.com/forum67.html, 
> http://forums.subratam.org/index.php?showforum=7, 
> http://aumha.net/viewforum.php?f=30, or other appropriate forums for 
> review by an expert in such matters, not here.**
>
> If the procedures look too complex - and there is no shame in 
> admitting this isn't your cup of tea - take the machine to a local, 
> reputable and independent (i.e., not BigBoxStoreUSA) computer repair 
> shop.
> -- 
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> morningglory wrote:
>> Using Spyware Terminator for the first time today, I found installed 
>> on my
>> computer Chat Watch (keylogger), which monitors my computer and sends
>> reports somewhere.
>> It is located on my Desktop, in a folder called "Drive Backup
Files.
>> When Spyware Terminator does an analysis, it says:
>>
>>
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave
>> MRU\*\gC:\aslframe.data.exe
>>
>>
>>
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave
>> MRU\exe\gC:\aslframe.data.exe
>>
>> How do I delete this?
>>
>> Spybot did not find this software.
> 

Are you certain someone did not install Chat Watch on your computer?
-------
*Report back, please*

> morningglory wrote:
>
>> Using Spyware Terminator for the first time today, I found installed on

>> my
>> computer Chat Watch (keylogger), which monitors my computer and sends 
>> reports
>> somewhere.
>> It is located on my Desktop, in a folder called "Drive Backup
Files.
>> When Spyware Terminator does an analysis, it says:
>>
>>
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave
>> MRU\*\gC:\aslframe.data.exe
>>
>>
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave
>> MRU\exe\gC:\aslframe.data.exe
>>
>> How do I delete this?
>>
>> Spybot did not find this software.

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/kb/827315

Run a /thorough/ check for hijackware, including posting your hijackthis log 
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
   http://aumha.org/a/quickfix.htm
   http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
   http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v2.0.2
(http://aumha.org/downloads/hijackthis.exe) is the preferred tool to use. 
It will help you to both identify and remove any hijackware/spyware with 
assistance from an expert.  **Post your log to 
http://forums.spybot.info/forumdisplay.php?f=22, 
http://castlecops.com/forum67.html, 
http://forums.subratam.org/index.php?showforum=7, 
http://aumha.net/viewforum.php?f=30, or other appropriate forums for review 
by an expert in such matters, not here.**

If the procedures look too complex - and there is no shame in admitting this 
isn't your cup of tea - take the machine to a local, reputable and 
independent (i.e., not BigBoxStoreUSA) computer repair shop.
-- 
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

morningglory wrote:
> Using Spyware Terminator for the first time today, I found installed on my
> computer Chat Watch (keylogger), which monitors my computer and sends
> reports somewhere.
> It is located on my Desktop, in a folder called "Drive Backup Files.
> When Spyware Terminator does an analysis, it says:
>
> HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave
> MRU\*\gC:\aslframe.data.exe
>
>
> HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg.32\OpenSave
> MRU\exe\gC:\aslframe.data.exe
>
> How do I delete this?
>
> Spybot did not find this software.