[RESOLVED] AVG Anti-Spyware reporting on my MX1000 Mouse

[CCT]

I get the report that my Logitech MX1000 mouse USB registry key is 'Adware.KeenValue'.

It points to the registry key 'HKLM\SYSTEM\ControlSet001\Enum\USB\Vid_046d&Pid_c 50e\5&27d1f7ab&0&2\Device Parameters\\ExtPropDescSemaphore'


Is this 'normal' or is there something I am missing about 'rats' in my USB mouse?

[geoscomp]

logitech is known for adware and spyware installing with their often extremely large and useless drivers..for example..why would a mouse need to check online everyday for driver updates? they'se been around forever..you'd think they would have the drivers down by now.

[CCT]

Yeah, but I am NOT using their drivers - just the Win XP Pro HID drivers.

I actually removed the USB line, deleted the registry entry, and rebooted.

AVG shows clear.

I shut down, reconnect the mouse, and reboot and rescan - BINGO! - AVG says it sees an 'infestation'.


NOW, I did have their drivers installed way back but I fealt there was WAY too much crap there so I uninstalled and went with the XP drivers.

You think maybe something is still somewhere in my registry Geos?


btw -I apologize - I know better than to post limited info BUT I did think you'd know I had checked some stuff out already.

Anyway, sorry.


I repeat though, You think maybe something is still somewhere in my registry ?

[geoscomp]

Sure sounds like it it either in the registry or hiding somewhere else in the drivers files..the fact that it isn't active till the mouse is installed is pretty strange though..usually reg entries are picked up by avg scans. Have you tried hijack this to make sure there aren't a bits of ligitech still around?

[MobilePCPhysician]

I would also advise running HijackThis.

[Ferrit]

I might try a antivirus scan online
www.bitdefender.com
I think its nothing more then a false positive if you dont have the logitech software installed

[NooNoo]

Oh and turn off system restore... you may need to go hunting in the driver cache to stop the logitech stuff reinstalling.

[CCT]

Summary of actions:

Scan with AVG-AntSpyWare showed Ad=ware-KeenValue in registry key as mentioned earlier.

Irun Norton Antivirus 2006 and daily scans with AdAware SE, Spybot S&D and HijackThis which showed nothing wrong.

Ran the Symantec scan for KeenValue separately and nothing.

Ran the suggested bitdefender scan and nothing.

So, I wnet into the registry under HKLM\SYSTEM\ControlSet001\Enum\USB and deleted ALL the keys for Logitech (both my G15 keyboard and MX1000 mouse).

I shut down, unplugged the mouse and keyboard, and rebooted.

Checked the registry and nothing added.

I shut down again, reconnected the mouse and keyboard, rebooted. They were installed ok.

Ran AVG-AntiSpyware again and - tada! - no infection.

I don't pretend to understand what was being detected because the present key for the mouse is:

'HKLM\SYSTEM\ControlSet001\Enum\USB\Vid_046d&Pid_c 50e\5&27d1f7ab&0&1' while the 'BAD' one was

'HKLM\SYSTEM\ControlSet001\Enum\USB\Vid_046d&Pid_c 50e\5&27d1f7ab&0&2'.


Would the change in that last value (ie, 1 versus 2) be the culprit?

Anyway, resolved. Thanks for the ideas.

[Ferrit]

I think you are looking at a false positive when several other scans found nothing

[slgrieb]

Almost certainly a false positive. Actually, there are no malware problems per se with Logitech's drivers, but some versions of their installation CDs did want to install WildTangent Game Channel and other things we can live without.

Newer Logitech drivers (like all the MX100 series) don't load up all the dreck you used to get. MX drivers don't auto-update, etc. If you run this mouse, you must install the software for it, but it is safe.

BTW, there are some reasons why AVG Free is.