[frozenthunder]

no problem...

during the restarts, i cant remember what i was doing the first time, but the second restart happened right after i switched on my computer after the first restart. nothing so far today...

on 31st december there was another restart...i turned on my computer signed in to msn messenger and went of for 5 minutes. when i came back my computer had restarted....

Edited by frozenthunder, 30 December 2006 - 09:55 PM.

[Advertisements]

Hi frozenthunder

I'd like to try one last scanner to see if anything is still hiding.

Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!

• Follow the Instruction Here for installation.
• Accept the License Agreement.
• Once the ActiveX installs,Click Full System Scan
• Once the download completes,the scan will begin automatically.
• The scan will take some time to finish,so please be patient.
• When the scan completes, click the Automatic cleaning (recommended) button.
• Click the Show Report button and Copy&Paste the entire report in your next reply.

Andy

[andydf]

Hi frozenthunder

I'd like to try one last scanner to see if anything is still hiding.

Please run the F-Secure Online Scanner

Note: This Scanner is for Internet Explorer Only!

• Follow the Instruction Here for installation.
• Accept the License Agreement.
• Once the ActiveX installs,Click Full System Scan
• Once the download completes,the scan will begin automatically.
• The scan will take some time to finish,so please be patient.
• When the scan completes, click the Automatic cleaning (recommended) button.
• Click the Show Report button and Copy&Paste the entire report in your next reply.

Andy

[frozenthunder]

here's the log....i had to cancel one of the disinfections as it was taking way too long. but the scan was complete...

Scanning Report
Tuesday, January 02, 2007 07:38:37 - 14:06:12

Computer name: YOUR-6S3LT0MYQT
Scanning type: Scan system for viruses, rootkits, spyware
Target: C:\
Result: 6 malware found
Tracking Cookie (spyware)

* System (Disinfected)
* System
* System
* System
* System
* System (Submitted)

Statistics
Scanned:

* Files: 34071
* System: 5283
* Not scanned: 8

Actions:

* Disinfected: 1
* Renamed: 0
* Deleted: 0
* None: 5
* Submitted: 1

Files not scanned:

* C:\PAGEFILE.SYS
* C:\WINDOWS\SYSTEM32\DRIVERS\DTSCSI.SYS
* C:\WINDOWS\SYSTEM32\DRIVERS\SPTD.SYS
* C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT
* C:\WINDOWS\SYSTEM32\CONFIG\SAM
* C:\WINDOWS\SYSTEM32\CONFIG\SECURITY
* C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE
* C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM

Options
Scanning engines:

* F-Secure Libra: 2.4.2, 2006-12-29
* F-Secure AVP: 7.0.171, 2007-01-02
* F-Secure Orion: 1.2.37, 2006-12-29
* F-Secure Blacklight: 1.0.31, 0000-00-00
* F-Secure Draco: 1.0.35, 0260-02-44
* F-Secure Pegasus: 1.19.0, 2006-11-19

Scanning options:

* Scan defined files: COM EXE SYS OV? BIN SCR DLL SHS HTM HTML HTT VBS JS INF VXD DO? XL? RTF CPL WIZ HTA PP? PWZ P?T MSO PIF . ACM ASP AX CNV CSC DRV INI MDB MPD MPP MPT OBD OBT OCX PCI TLB TSP WBK WBT WPC WSH VWP WML BOO HLP TD0 TT6 MSG ASD JSE VBE WSC CHM EML PRC SHB LNK WSF {* PDF ZL? XML ZIP XXX
* Use Advanced heuristics

Copyright © 1998-2006 Product support |Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name.This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.

[andydf]

When you say you cancelled one of the disinfections can you be more specific, what was the infection it was trying to clean?

[frozenthunder]

i cant remember the name of the infection.... but it was cleaning the fifth out of six infections when it sort of hung and the cleaning process bar stopped moving for more than an hour so i cancelled the disinfection of that particular infection.

[andydf]

Ok we need to recap, can you tell me what (if any) problems you are still having.

[frozenthunder]

everything seems pretty fine no...overall computer speed has increased. the internet speed is laggy but alot of people in my area are having internet issues due to the taiwan quake. so pretty much everything seems to be in order.. =)

[andydf]

Hi frozenthunder

I'm confident that the F-Secure scan only found cookies

Target: C:\
Result: 6 malware found
Tracking Cookie (spyware)

But because you said it failed during cleaning, i'd like to be sure.

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, in the menu, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.

post the results in your reply

Andy

[frozenthunder]

the report...

A0119703.exe;C:\System Volume Information\_restore{FC7B549B-A9DB-4F65-8D9B-B165C7FAB2D5}\RP264;BackDoor.Oscar;Deleted.;
A0134508.exe;C:\System Volume Information\_restore{FC7B549B-A9DB-4F65-8D9B-B165C7FAB2D5}\RP283;Win32.HLLW.Kelvin;Deleted.;
A0137002.reg;C:\System Volume Information\_restore{FC7B549B-A9DB-4F65-8D9B-B165C7FAB2D5}\RP291;Trojan.StartPage.1505;Deleted.;

[andydf]

Ok all looks good those files are located in your system restore folder and unless you use system restore they are harmless.

So i'll refer back to this post

http://www.geekstogo...s...st&p=864446

Follow the directions and you'll be good to go

Andy

[frozenthunder]

thanks for all your patience and help!

[frozenthunder]

sorry to bother but today my computer restarted 5 times by itself. the first time it restarted, i had warcraft on and i encountered the blue screen error message. when i tried to restart my computer , when i booted it up again it kept restarting by itself...

[andydf]

Well i'm fairly certain that it is not malware related. However........
1. Download combofix.exe from one of the links below:

http://download.blee...Bs/combofix.exe
http://www.techsuppo...ls/combofix.exe

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Did you take note of the error code that was on the Blue screen? if not make a note of the code next time and post it here.

Andy

[frozenthunder]

i didnt really take note of any error codes and the blue screen has not come out again so far...

heres the combofix report

"Owner" - 07-01-13 9:19:11 Service Pack 2
ComboFix 07-01-12 - Running from: "C:\Documents and Settings\Owner\My Documents\My Completed Downloads"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\windows


((((((((((((((((((((((((((((((( Files Created from 2006-12-13 to 2007-01-13 ))))))))))))))))))))))))))))))))))


2007-01-13 08:43 <DIR> d-------- C:\WINDOWS\LastGood
2007-01-13 08:43 <DIR> d-------- C:\WINDOWS\ie7updates
2007-01-13 08:43 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\PCF-VLC
2007-01-03 21:10 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\Reallusion
2007-01-03 21:07 <DIR> d-------- C:\Program Files\Reallusion
2007-01-03 21:07 <DIR> d-------- C:\Program Files\Common Files\Reallusion
2007-01-02 16:10 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\Participatory Culture Foundation
2007-01-02 16:09 <DIR> d-------- C:\Program Files\Participatory Culture Foundation
2006-12-31 16:48 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\Application Data\TEMP
2006-12-31 16:47 50,688 --a------ C:\WINDOWS\system32\wbhelp2.dll
2006-12-31 16:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Google
2006-12-31 16:14 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\Megaupload
2006-12-31 16:13 <DIR> d-------- C:\Program Files\Megaupload
2006-12-31 15:59 <DIR> d-------- C:\Program Files\MegauploadToolbar
2006-12-31 15:59 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\MegauploadToolbar
2006-12-29 12:57 <DIR> d-------- C:\Program Files\Wisdom-soft AutoScreenRecorder Free
2006-12-24 11:26 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2006-12-23 00:40 <DIR> d----c--- C:\Downloads
2006-12-23 00:32 <DIR> d-------- C:\Program Files\FlashGet
2006-12-22 17:08 <DIR> d-------- C:\Program Files\TVUPlayer
2006-12-21 16:23 <DIR> d----c--- C:\MFT 31878
2006-12-21 10:32 24,072 --a------ C:\WINDOWS\system32\uxtuneup.dll
2006-12-21 10:31 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2006-12-21 10:31 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\TuneUp Software
2006-12-21 10:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\TuneUp Software


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-13 09:16 -------- d-------- C:\Program Files\mozilla firefox
2007-01-13 08:36 -------- d-------- C:\Program Files\steam-down
2007-01-13 01:06 -------- d-------- C:\Program Files\warcraft iii
2007-01-08 21:40 -------- d-------- C:\DOCUME~1\Owner\Application Data\metacafe
2007-01-06 17:42 -------- d-------- C:\DOCUME~1\Owner\Application Data\google
2007-01-03 21:07 -------- d--h----- C:\Program Files\installshield installation information
2006-12-31 17:24 -------- d-------- C:\Program Files\google
2006-12-31 16:50 -------- d-------- C:\Program Files\dap
2006-12-26 12:26 -------- d-------- C:\Program Files\bitcomet
2006-12-21 10:37 -------- d-------- C:\Program Files\metacafe
2006-12-21 10:30 -------- d-------- C:\Program Files\Common Files\wise installation wizard
2006-12-19 07:06 -------- d-------- C:\Program Files\porttrigger
2006-12-19 07:05 -------- d-------- C:\Program Files\superantispyware
2006-12-18 10:01 -------- d-------- C:\Program Files\maiet
2006-12-08 18:28 -------- d-------- C:\Program Files\ewido anti-malware
2006-12-08 18:24 -------- d-------- C:\Program Files\yahoo!
2006-12-08 18:24 -------- d-------- C:\Program Files\ccleaner
2006-12-07 15:47 -------- d-------- C:\DOCUME~1\Owner\Application Data\murasu
2006-12-07 14:40 2362184 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-12-04 18:49 -------- d-------- C:\Program Files\usb storage rw
2006-12-04 18:47 -------- d-------- C:\Program Files\msn messenger
2006-12-04 18:39 -------- d-------- C:\Program Files\itunes
2006-12-04 18:36 -------- d-------- C:\Program Files\hamachi
2006-12-04 18:35 -------- d-------- C:\Program Files\filmloop player
2006-12-04 18:35 -------- d-------- C:\Program Files\daemon tools
2006-12-04 18:28 -------- d-------- C:\Program Files\ares
2006-12-04 16:12 -------- d-------- C:\DOCUME~1\Owner\Application Data\superantispyware.com
2006-12-04 12:52 -------- d-------- C:\Program Files\grisoft
2006-12-04 12:20 -------- d-------- C:\Program Files\lavasoft
2006-12-04 12:20 -------- d-------- C:\DOCUME~1\Owner\Application Data\lavasoft
2006-11-24 20:46 -------- d-------- C:\Program Files\divx
2006-11-22 23:05 -------- d-------- C:\DOCUME~1\Owner\Application Data\apple computer
2006-11-22 18:56 -------- d-------- C:\Program Files\movie maker
2006-11-22 11:54 -------- d-------- C:\Program Files\ipod
2006-11-22 11:49 -------- d-------- C:\Program Files\apple software update
2006-11-21 11:26 -------- d-------- C:\Program Files\microsoft works
2006-11-21 11:26 -------- d-------- C:\Program Files\messenger
2006-11-21 11:26 -------- d-------- C:\Program Files\easy internet signup
2006-11-19 18:57 -------- d-------- C:\Program Files\westvision
2006-11-18 13:23 -------- d-------- C:\Program Files\stereogram explorer
2006-11-17 16:03 -------- d-------- C:\Program Files\msxml 4.0
2006-11-16 12:47 -------- d-------- C:\DOCUME~1\Owner\Application Data\msn6
2006-11-16 07:55 4 --a------ C:\WINDOWS\info147.sys
2006-11-08 13:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-02 21:11 137336 --a------ C:\WINDOWS\system32\metacafe.scr
2006-10-19 21:56 713216 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-18 17:32 807032 --a------ C:\WINDOWS\system32\wmv9dmod.dll
2006-10-17 12:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll
2006-10-17 12:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll
2006-10-17 12:05 206336 --------- C:\WINDOWS\system32\winfxdocobj.exe
2006-10-17 12:05 105984 --a------ C:\WINDOWS\system32\url.dll
2006-10-17 12:04 101376 --a------ C:\WINDOWS\system32\occache.dll
2006-10-17 12:03 17408 --a------ C:\WINDOWS\system32\corpol.dll
2006-10-17 11:58 61952 --------- C:\WINDOWS\system32\icardie.dll
2006-10-17 11:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 11:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll
2006-10-17 11:57 266752 --------- C:\WINDOWS\system32\iertutil.dll
2006-10-17 11:56 45568 --a------ C:\WINDOWS\system32\mshta.exe
2006-10-17 11:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll
2006-10-17 11:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll
2006-10-13 20:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"NVIEW"="rundll32.exe nview.dll,nViewLoadHook"
"ares"="\"C:\\Program Files\\Ares\\Ares.exe\" -h"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"googletalk"="\"C:\\Program Files\\Google\\Google Talk\\googletalk.exe\" /autostart"
"Steam"="\"C:\\Program Files\\Steam-Down\\Steam.exe\" -silent"
"Democracy Player"="C:\\Program Files\\Participatory Culture Foundation\\Democracy Player\\Democracy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"hp Silent Service"="C:\\Windows\\system32\\HpSrvUI.exe"
"hpScannerFirstBoot"="c:\\hp\\drivers\\scanners\\scannerfb.exe"
"KBD"="C:\\HP\\KBD\\KBD.EXE"
"StorageGuard"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r"
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /installquiet /keeploaded /nodetect"
"PS2"="C:\\WINDOWS\\system32\\ps2.exe"
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Alcatel\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"IE Accelerator"="D:\\chess\\Booster\\IEAccelerator.exe /Auto"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"YeppStudioAgent"="C:\\Program Files\\Samsung\\Samsung Media Studio\\SamsungMediaStudioAgent.exe"
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"FilmLoop"="\"C:\\Program Files\\FilmLoop Player\\FilmLoop.exe\" -hide"
"QuickTime Task"="\"C:\\Program Files\\K-Lite Codec Pack\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"DownloadAccelerator"="\"C:\\Program Files\\DAP\\DAP.EXE\" /STARTUP"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Microsoft Update Machine"="cfgroot.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Microsoft Update Machine"="cfgroot.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=dword:00000001
"AllowUnhashedWebView"=dword:00000001
"WizmaxBackup_NoDriveTypeAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"WizmaxBackup_NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0

HKLM\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs*
UxTuneUp


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\1-Click Maintenance.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Symantec NetDetect.job

Completion time: 07-01-13 9:23:57

[andydf]

Well that showed nothing serious, only this file C:\WINDOWS\info147.sys which seems to be related to Virtua Girl (assuming you had it installed) which is known to cause popups as stated here http://www.fbmsoftwa...fo147_sys/1103/ If you have uninstalled this program then you can delete this file.

Without the error code from the blue screen it is difficult to figure out what caused the problem. Have you had any more BSOD?

Let me know how thing are

Andy