My Computer is ruined :(

retired_bouka12 · 09-19-2007, 03:44 PM

Sorry to bring this problem here but basically I dont have a clue where to begin with the virus/spyware problems my computer has. Popups are appearing pretty much every 30 seconds and it's really getting annoying now. Any advice on how to sort it out would be great.

retired_bouka12 · 09-19-2007, 03:45 PM

Hijackthis Logfile if that gives any ideas?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:00:30, on 18/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C

WINDOWS\System32\smss.exe
C

WINDOWS\system32\winlogon.exe
C

WINDOWS\system32\services.exe
C

WINDOWS\system32\lsass.exe
C

WINDOWS\system32\svchost.exe
C

WINDOWS\System32\svchost.exe
C

WINDOWS\system32\spoolsv.exe
C

WINDOWS\Explorer.EXE
C

Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C

Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C

Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C

WINDOWS\System32\CTsvcCDA.EXE
c

program files\mcafee.com\agent\mcdetect.exe
c

PROGRA~1\mcafee.com\agent\mctskshd.exe
c

PROGRA~1\mcafee.com\vso\mcvsrte.exe
C

WINDOWS\System32\svchost.exe
C

WINDOWS\System32\MsPMSPSv.exe
C

Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C

Program Files\Dell\Media Experience\PCMService.exe
C

Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C

WINDOWS\system32\dla\tfswctrl.exe
C

Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe
C

WINDOWS\system32\Rundll32.exe
C

Program Files\Real\RealPlayer\RealPlay.exe
C

PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C

WINDOWS\vsnpstd.exe
C

Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C

Program Files\Common Files\{F090980D-0AE9-1033-0517-04120503002c}\Update.exe
C

Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C

Program Files\iTunes\iTunesHelper.exe
C

PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C

Program Files\iPod\bin\iPodService.exe
C

Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C

Program Files\Thomson SpeedTouch\SpeedTouch 120g Wireless USB Monitor\PRISMSVR.EXE
C

Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54GSv2.exe
C

WINDOWS\System32\svchost.exe
C

Program Files\MSN Messenger\usnsvc.exe
C

WINDOWS\System32\dlbtcoms.exe
C

Program Files\WinAble\winable.exe
C

Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C

Program Files\MSN Messenger\msnmsgr.exe
C

Program Files\Windows Media Player\wmplayer.exe
C

Program Files\Sports Interactive\Football Manager 2007\fm.exe
C

DOCUME~1\JAMIES~1\LOCALS~1\Temp\~e5.0001
C

Program Files\Internet Explorer\iexplore.exe
C

Documents and Settings\Jamie Spencer\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.co.uk/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.co.uk/myway
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=C

WINDOWS\system32\uckhdjevkf\lsass.exe
F3 - REG:win.ini: run=C

WINDOWS\system32\uckhdjevkf\lsass.exe
O1 - Hosts: 1.1.1.1 f-secure.com
O1 - Hosts: 1.1.1.1 www.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.f-secure.com
O1 - Hosts: 1.1.1.1 ftp.sophos.com
O1 - Hosts: 1.1.1.1 liveupdate.symantec.com
O1 - Hosts: 1.1.1.1 customer.symantec.com
O1 - Hosts: 1.1.1.1 dispatch.mcafee.com
O1 - Hosts: 1.1.1.1 download.mcafee.com
O1 - Hosts: 1.1.1.1 rads.mcafee.com
O1 - Hosts: 1.1.1.1 mast.mcafee.com
O1 - Hosts: 1.1.1.1 my-etrust.com
O1 - Hosts: 1.1.1.1 www.my-etrust.com
O1 - Hosts: 1.1.1.1 nai.com
O1 - Hosts: 1.1.1.1 www.nai.com
O1 - Hosts: 1.1.1.1 networkassociates.com
O1 - Hosts: 1.1.1.1 secure.nai.com
O1 - Hosts: 1.1.1.1 securityresponse.symantec.com
O1 - Hosts: 1.1.1.1 service1.symantec.com
O1 - Hosts: 1.1.1.1 sophos.com
O1 - Hosts: 1.1.1.1 www.sophos.com
O1 - Hosts: 1.1.1.1 support.microsoft.com
O1 - Hosts: 1.1.1.1 symantec.com
O1 - Hosts: 1.1.1.1 www.symantec.com
O1 - Hosts: 1.1.1.1 update.symantec.com
O1 - Hosts: 1.1.1.1 updates.symantec.com
O1 - Hosts: 1.1.1.1 us.mcafee.com
O1 - Hosts: 1.1.1.1 vil.nai.com
O1 - Hosts: 1.1.1.1 viruslist.com
O1 - Hosts: 1.1.1.1 www.viruslist.com
O1 - Hosts: 1.1.1.1 grisoft.com
O1 - Hosts: 1.1.1.1 www.grisoft.com
O1 - Hosts: 1.1.1.1 free.grisoft.com
O1 - Hosts: 1.1.1.1 trendmicro.com
O1 - Hosts: 1.1.1.1 housecall.trendmicro.com
O1 - Hosts: 1.1.1.1 www.trendmicro.com
O1 - Hosts: 1.1.1.1 pandasoftware.com
O1 - Hosts: 1.1.1.1 www.pandasoftware.com
O1 - Hosts: 1.1.1.1 usa.kaspersky.com
O1 - Hosts: 1.1.1.1 ewido.net
O1 - Hosts: 1.1.1.1 zonelabs.com
O1 - Hosts: 1.1.1.1 www.zonelabs.com
O1 - Hosts: 1.1.1.1 bitdefender.com
O1 - Hosts: 1.1.1.1 www.bitdefender.com
O1 - Hosts: 1.1.1.1 download.bitdefender.com
O1 - Hosts: 1.1.1.1 upgrade.bitdefender.com
O1 - Hosts: 1.1.1.1 spywareinfo.com
O1 - Hosts: 1.1.1.1 www.spywareinfo.com
O1 - Hosts: 1.1.1.1 merijn.org
O1 - Hosts: 1.1.1.1 www.merijn.org
O1 - Hosts: 1.1.1.1 sysinternals.com
O1 - Hosts: 1.1.1.1 www.sysinternals.com
O1 - Hosts: 1.1.1.1 onguardonline.gov
O1 - Hosts: 1.1.1.1 www.onguardonline.gov
O1 - Hosts: 1.1.1.1 avast.com
O1 - Hosts: 1.1.1.1 www.avast.com
O1 - Hosts: 1.1.1.1 safety.live.com
O1 - Hosts: 1.1.1.1 www.paretologic.com
O1 - Hosts: 1.1.1.1 paretologic.com
O1 - Hosts: 1.1.1.1 virusscan.jotti.org
O1 - Hosts: 1.1.1.1 services.google.com
O1 - Hosts: 1.1.1.1 www.webroot.com
O1 - Hosts: 1.1.1.1 webroot.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C

Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12BCAC3E-6BD4-1604-F249-1DE33C94FFCC} - C

WINDOWS\system32\ggomhk.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C

WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C

Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c

progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [PCMService] "C

Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C

Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C

WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C

Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [CTSysVol] C

Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [UpdReg] C

WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "c

PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] C

PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C

PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [RealTray] C

Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C

Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VirusScan] c

PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C

PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [snpstd] C

WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C

Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [{F090980D-0AE9-1033-0517-04120503002c}] "C

Program Files\Common Files\{F090980D-0AE9-1033-0517-04120503002c}\Update.exe" mc-110-12-0001411
O4 - HKLM\..\Run: [iTunesHelper] "C

Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [{F090980D-0AE8-1033-0517-04120503002c}] "C

Program Files\Common Files\{F090980D-0AE8-1033-0517-04120503002c}\Update.exe" mc-110-12-0001411
O4 - HKLM\..\Run: [WinTouch] C

Program Files\WinTouch\WinTouch.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C

Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [PRISMSVR.EXE] "C

Program Files\Thomson SpeedTouch\SpeedTouch 120g Wireless USB Monitor\PRISMSVR.EXE" /APPLY
O4 - HKCU\..\Run: [MsnMsgr] "C

Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C

Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Microsoft Location Finder] "C

Program Files\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [Aida] "C

WINDOWS\FNTS~1\winword.exe" -vt yazb
O4 - HKCU\..\Run: [Wczmf] C

Program Files\S?mantec\w?nlogon.exe
O4 - HKCU\..\Run: [IpWins] C

Program Files\Ipwindows\ipwins.exe
O4 - HKCU\..\Run: [Words] C

Program Files\Words\Words.exe
O4 - HKCU\..\Run: [updateMgr] "C

Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8
O4 - HKCU\..\Run: [WinAble] C

Program Files\WinAble\winable.exe
O4 - HKCU\..\Policies\Explorer\Run: [{F090980D-0AE9-1033-0517-04120503002c}] "C

Program Files\Common Files\{F090980D-0AE9-1033-0517-04120503002c}\Update.exe" te-110-12-0000282
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C

WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C

WINDOWS\System32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{F090980D-0AE9-1033-0517-04120503002c}] "C

Program Files\Common Files\{F090980D-0AE9-1033-0517-04120503002c}\Update.exe" te-110-12-0000282 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C

WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C

WINDOWS\System32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{F090980D-0AE9-1033-0517-04120503002c}] "C

Program Files\Common Files\{F090980D-0AE9-1033-0517-04120503002c}\Update.exe" te-110-12-0000282 (User 'Default user')
O4 - Startup: lsass.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C

Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SpeedTouch 120g Wireless USB Monitor.lnk = C

Program Files\Thomson SpeedTouch\SpeedTouch 120g Wireless USB Monitor\st120g.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C

WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C

Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C

Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {E991BDE0-9816-4094-853E-6BDB60F0342D} (Get_ActiveX Control) - http://apps.corel.com/nos_dl_manager...etOpPlugin.ocx
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C

Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C

Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: Client IP-IPX - Unknown owner - C

WINDOWS\system32\svchosts.exe (file missing)
O23 - Service: Command Service (cmdService) - Unknown owner - C

WINDOWS\SmFtaWUgU3BlbmNlcg\command.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C

WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: dlbt_device - Dell - C

WINDOWS\System32\dlbtcoms.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C

Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c

program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c

PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c

PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C

PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c

PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C

Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Network Monitor - Unknown owner - C

Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: WUSB54GSv2SVC - GEMTEKS - C

Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe

--
End of file - 12416 bytes

trotamundos · 09-19-2007, 03:45 PM

ad-aware
Spybot

get them, run them, delete loads of bad stuff.

I think.

retired_bouka12 · 09-19-2007, 03:50 PM

Quote:

Originally posted by Herman Bloom:
ad-aware
Spybot

get them, run them, delete loads of bad stuff.

I think.

thanks, i'll give them a go, i've already tried AVGAS which has apparently deleted some stuff but the problem is still there.

trotamundos · 09-19-2007, 04:24 PM

Each program seems to find different stuff for me. Might as well go for as amnay as possible

retired_edkimbal · 09-19-2007, 04:38 PM

Remove these using hijackthis:

O4 - HKCU\..\Run: [IpWins] C

Program Files\Ipwindows\ipwins.exe

O4 - HKCU\..\Run: [Words] C

Program Files\Words\Words.exe

O4 - HKCU\..\Run: [WinAble] C

Program Files\WinAble\winable.exe

Thats all i can find in that log.

retired_edkimbal · 09-19-2007, 04:39 PM

You may when you need to disable yout system restore and run the adaware etc in Safe Mode to clear them out completely.

Then restart and re-nable system restore. Many of these malware programs re-infect via System Restore...

retired_srini_aug1 · 09-19-2007, 04:40 PM

Can i stick my problem in here aswell? good.

My computer sometimes refuses to turn on, and i have to leave it for about 10 mins after i turn it off to turn it on again.

Also it is now simply turning itself off when im in windows. Im not playing games or anything taxing and it just loses power.

So, is my PSU dead, and can i simply replace it and all be well.

I have checked connections to/from psu to hard drives/modo, gc etc, and all seem fine.

retired_edkimbal · 09-19-2007, 04:50 PM

If your PSU dead it should be easily replaced.

Do you have a lot of USB devices connected as this may be overloading your PSU.

retired_srini_aug1 · 09-19-2007, 05:04 PM

just my mouse and my wireless stick. Even when i disconnect them all it still acts the same.

I'm going to get a new case aswell, had mine a bit too long, and as long as im replacing the PSU i might aswell replace it at the same time.

My Computer is ruined :(

Grab a beer, sit back and relax.

My Computer is ruined :(