Computer Support Forum

Strange pop up keep coming back

Question: Strange pop up keep coming back

Hi,
Everytime when i restart my computer i will get some strange wording pop up. Run ad-aware and have around 44 error. Remove them using ad-aware but when i restart computer and scan again the same error come back. Hope you all can help thanks.

Below are the log of each individual scan:

Panda active scan


Incident Status Location

Virus:Trj/Lineage.GCC Disinfected Operating system
Virus:Trj/Legmir.ATJ Disinfected Operating system
Virus:Trj/Wow.RA Disinfected Operating system
Virus:Trj/Lineage.FWB Disinfected Operating system
Virus:trj/spabot.e Disinfected Operating system
Adware:adware/baidubar Not disinfected Windows Registry
Virus:W32/Winko.P.worm Disinfected C:\auto.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Desktop\Cleanup\SDFix.exe[SDFix\apps\Process.exe]
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\Administrator\Desktop\Cleanup\SmitfraudFix\restart.exe
Virus:Trj/Lineage.gen Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\LYLOADER.EXE
Virus:Trj/Lineage.GCH Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\SHQMANGR.DLL
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8RAKC4NO\jh0619[1].exe
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8RAKC4NO\qj0617[1].exe
Virus:Generic Malware Disinfected C:\HJT\backups\backup-20060902-103504-702.dll
Adware:Adware/Borlander Not disinfected C:\Program Files\symp\flzc.dll
Virus:Trj/Lineage.FRU Disinfected C:\Program Files\WZCN\cn_ie_wzcn.dll
Virus:Trj/Wow.RA Disinfected C:\WINDOWS\123
Virus:Trj/Wow.RA Disinfected C:\WINDOWS\49400MM.DLL
Virus:Trj/Legmir.ATJ Disinfected C:\WINDOWS\49400WL.DLL
Virus:Trj/Legmir.ATJ Disinfected C:\WINDOWS\555888
Virus:Trj/Wow.RA Disinfected C:\WINDOWS\888
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\bxsnlx.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\dwddhv.exe
Possible Virus. Not disinfected C:\WINDOWS\ekyfgc.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\futgfh.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\fxftil.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\fymixb.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\gfzkwi.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\htotyh.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\iczwaz.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\idlcnp.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\ipvyyv.exe
Virus:Trj/Legmir.ATJ Disinfected C:\WINDOWS\llllllab
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\lubzlz.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\phtwfu.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\plmoto.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\ptwjiy.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\qrxhrw.exe
Adware:Adware/BaiduBar Not disinfected C:\WINDOWS\system32\612fd7We.dll
Virus:Trj/BHO.O Disinfected C:\WINDOWS\system32\6b38Kx7T.dll
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\system32\drivers\etc\hosts.20061114-021815.backup
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\drivers\vdjkbf58.sys
Virus:W32/ZLFake.A.drp Disinfected C:\WINDOWS\system32\dtJ46pqB.exe
Virus:Bck/Hupigon.KGB Disinfected C:\WINDOWS\system32\F87D2198(2).DLL
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\system32\isqotp.dll
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\system32\k11937460752.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\system32\k11937476962.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\k11938414462.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\k11939072683.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\k11939163133.exe
Virus:Trj/Lineage.FWB Disinfected C:\WINDOWS\system32\k11939163155.exe
Adware:Adware/BaiduBar Not disinfected C:\WINDOWS\system32\KKIgQhmd.dll
Virus:Generic Trojan Disinfected C:\WINDOWS\system32\mcert.dll
Adware:Adware/VideoActiveXObject Not disinfected C:\WINDOWS\system32\mediaobjsetup.123.exe
Virus:Trj/Harnig.EQ Disinfected C:\WINDOWS\system32\n1178390509k.exe
Virus:Bck/Hupigon.KGB Disinfected C:\WINDOWS\system32\n1178921164k.exe
Adware:Adware/BHO Not disinfected C:\WINDOWS\system32\paoOFVhn.dll
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\scrsys16_070418.scr
Virus:Trj/Lineage.GCH Disinfected C:\WINDOWS\system32\SHQMANGR.DLL
Adware:Adware/NewWeb Not disinfected C:\WINDOWS\system32\vdjkbf58.dll
Virus:W32/Spamta.QO.worm Disinfected C:\WINDOWS\system32\vvrtshgi.dll
Virus:Trj/Patchlog.A Disinfected C:\WINDOWS\system32\winlogon(2)(2).exe
Virus:Trj/LastGood.B Disinfected C:\WINDOWS\system32\winlogon.exe
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\winsys16_070418.dll
Virus:Generic Trojan Disinfected C:\WINDOWS\system32\wsock32k.dll
Adware:Adware/BHO Not disinfected C:\WINDOWS\system32\Y5pyg500.dll
Virus:Generic Trojan Disinfected C:\WINDOWS\temp\4GPiPevG.exe
Virus:Trj/Lineage.GCH Disinfected C:\WINDOWS\temp\SHQMANGR.DLL
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\xwfeyx.exe
Adware:Adware/Borlander Not disinfected C:\~deB.tmp
Adware:Adware/Borlander Not disinfected C:\~deD.tmp
DSS scan

Deckard's System Scanner v20071014.68
Run by Administrator on 2007-11-02 21:01:22
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
64: 2007-11-02 13:01:26 UTC - RP208 - Deckard's System Scanner Restore Point
63: 2007-11-02 12:44:38 UTC - RP207 - System Checkpoint
62: 2007-11-01 09:23:37 UTC - RP206 - Restore Operation
61: 2007-10-30 16:16:13 UTC - RP205 - System Checkpoint
60: 2007-10-29 00:35:56 UTC - RP204 - Restore Operation


-- First Restore Point --
1: 2007-08-04 05:56:31 UTC - RP145 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 9:02:12 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\SnoopFreeSvc.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\program files\internet explorer\iexplore.exe
C:\WINDOWS\SnoopFreeUI.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\k11940028342.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\HJT\Administrator.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070418.dll start
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GenProtect] C:\WINDOWS\GenProtect.exe
O4 - HKLM\..\Run: [Kvsc3] C:\WINDOWS\Kvsc3.exe
O4 - HKLM\..\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exe
O4 - HKLM\..\Run: [MsIMMs32] C:\WINDOWS\MsIMMs32.exe
O4 - HKLM\..\Run: [NVDispDrv] C:\WINDOWS\NVDispDrv.exE
O4 - HKLM\..\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - HKLM\..\Run: [MsPrint32D] C:\WINDOWS\MsPrint32D.exe
O4 - HKLM\..\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - HKLM\..\Run: [DbgHlp32] C:\WINDOWS\DbgHlp32.exe
O4 - HKLM\..\Run: [ALMJ] C:\WINDOWS\system32\ALMJ.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120979109812
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)


-- HijackThis Fixed Entries (C:\HJT\backups\) ----------------------------------

backup-20050814-185530-101 O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
backup-20050814-185530-197 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.bestwebslinks.com/
backup-20050814-185530-271 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.bestwebslinks.com/search.php?qq=%1
backup-20050814-185530-491 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.bestwebslinks.com/search.php?qq=%1
backup-20050814-185530-574 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.bestwebslinks.com/search.php?qq=%1
backup-20050814-185530-834 O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\system32\msmsgs.exe
backup-20051227-160935-217 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
backup-20051227-160935-437 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
backup-20051227-160935-520 O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
backup-20051227-160935-612 O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
backup-20060902-103504-702 O2 - BHO: ????????? - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Progra~1\Baidu\bar\BaiDuBar.dll
backup-20060902-103505-129 O8 - Extra context menu item: ???-????MP3 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM
backup-20060902-103505-452 O8 - Extra context menu item: ???-???????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM
backup-20060902-103505-586 O8 - Extra context menu item: ???-???????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM
backup-20060902-103505-609 O8 - Extra context menu item: ???-??????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM
backup-20060902-103505-629 O8 - Extra context menu item: ???-??????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM
backup-20060902-103505-719 O8 - Extra context menu item: ???-?????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM
backup-20060902-103505-830 O3 - Toolbar: ????????? - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Progra~1\Baidu\bar\BaiDuBar.dll
backup-20060902-103505-918 O8 - Extra context menu item: ???-??????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM
backup-20070204-140923-443 O2 - BHO: Yahoo ToolBar - {BE756CFF-ADB4-4bc5-A35F-19E546E5710E} - C:\WINDOWS\system32\winnet.dll (file missing)
backup-20070204-140924-124 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-140924-177 O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\uirxihi.dll (file missing)
backup-20070204-140924-391 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)
backup-20070204-140924-469 O4 - HKLM\..\Run: [ChkDisk] C:\WINDOWS\system32\chk_disk.exe
backup-20070204-140924-689 O4 - HKLM\..\Run: [mstds.exe] c:\windows\system32\mstds.exe
backup-20070204-140924-864 O20 - Winlogon Notify: instcat - instcat.dll (file missing)
backup-20070204-141350-324 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)
backup-20070204-141350-344 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-141632-343 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)
backup-20070204-141632-612 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-141945-146 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-141945-876 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 SnoopFree (SnoopFree Driver) - c:\windows\system32\drivers\snopfree.sys
R3 cmudax (C-Media High Definition Audio Interface) - c:\windows\system32\drivers\cmudax.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
R3 Pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

S2 ntio256 (Input and output operations) - c:\windows\system32\ntio256.sys (file missing)
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
S3 EXAMPLE1 - c:\windows\system32\ksys.sys (file missing)
S3 genmcmn (Scroll Mouse Driver) - c:\windows\system32\drivers\gmfiltr.sys (file missing)
S3 NPF (Netgroup Packet Filter) - c:\windows\system32\drivers\npf.sys <Not Verified; CACE Technologies; WinPcap Netgroup Packet Filter Driver>
S3 npkcrypt - c:\program files\lineageii\system\npkcrypt.sys (file missing)
S3 scsk4 (SCSK4 Driver Service) - c:\windows\system32\drivers\scsk4.sys <Not Verified; SoftCamp Co., Inc.; SoftCamp Secure KeyStroke>
S3 XDva004 - c:\windows\system32\xdva004.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 SnoopFreeSvc (Snoop Free Service) - system32\snoopfreesvc.exe

S2 10DA1C34 - c:\windows\system32\30b9f538.exe -k <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 ServiceLayer - "c:\program files\common files\pcsuite\services\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8169/8110 Family Gigabit Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8169&SUBSYS_18531019&REV_10\4&23C0B1C&0&50F0
Manufacturer: Realtek Semiconductor Corp.
Name: Realtek RTL8169/8110 Family Gigabit Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8169&SUBSYS_18531019&REV_10\4&23C0B1C&0&50F0
Service: RTL8023


-- Scheduled Tasks -------------------------------------------------------------

2007-11-02 21:00:00 350 --a------ C:\WINDOWS\Tasks\At22.job
2007-11-02 20:58:00 270 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
2007-11-02 20:01:37 350 --a------ C:\WINDOWS\Tasks\At21.job
2007-11-02 06:01:00 350 --a------ C:\WINDOWS\Tasks\At7.job
2007-11-02 05:01:00 350 --a------ C:\WINDOWS\Tasks\At6.job
2007-11-02 04:01:00 350 --a------ C:\WINDOWS\Tasks\At5.job
2007-11-02 03:01:00 350 --a------ C:\WINDOWS\Tasks\At4.job
2007-11-02 02:01:00 350 --a------ C:\WINDOWS\Tasks\At3.job
2007-11-02 01:01:00 350 --a------ C:\WINDOWS\Tasks\At2.job
2007-11-02 00:01:00 350 --a------ C:\WINDOWS\Tasks\At1.job
2007-11-01 23:01:00 350 --a------ C:\WINDOWS\Tasks\At24.job
2007-11-01 22:01:00 350 --a------ C:\WINDOWS\Tasks\At23.job
2007-11-01 17:01:47 350 --a------ C:\WINDOWS\Tasks\At18.job
2007-10-29 08:01:54 350 --a------ C:\WINDOWS\Tasks\At9.job
2007-10-28 19:01:00 350 --a------ C:\WINDOWS\Tasks\At20.job
2007-10-28 18:01:00 350 --a------ C:\WINDOWS\Tasks\At19.job
2007-10-28 16:01:00 350 --a------ C:\WINDOWS\Tasks\At17.job
2007-10-28 15:01:00 350 --a------ C:\WINDOWS\Tasks\At16.job
2007-10-28 14:01:00 350 --a------ C:\WINDOWS\Tasks\At15.job
2007-10-28 13:01:31 350 --a------ C:\WINDOWS\Tasks\At14.job
2007-10-27 12:01:00 350 --a------ C:\WINDOWS\Tasks\At13.job
2007-10-27 11:01:00 350 --a------ C:\WINDOWS\Tasks\At12.job
2007-10-27 10:01:46 350 --a------ C:\WINDOWS\Tasks\At11.job
2007-10-27 07:01:00 350 --a------ C:\WINDOWS\Tasks\At8.job
2007-10-18 16:04:58 350 --a------ C:\WINDOWS\Tasks\At10.job


-- Files created between 2007-10-02 and 2007-11-02 -----------------------------

2007-11-02 20:56:51 2214 --a------ C:\WINDOWS\system32\SHQMANGR.DLL
2007-11-02 20:56:51 22920 --a------ C:\WINDOWS\system32\LYLOADMR.EXE
2007-11-02 20:24:08 73 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys
2007-11-02 20:24:08 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware>
2007-11-02 19:36:54 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-11-02 19:36:52 0 d-------- C:\WINDOWS\LastGood
2007-11-02 19:32:36 20480 --a------ C:\WINDOWS\system32\upxdnd.dll
2007-11-02 19:32:36 12564 --a------ C:\WINDOWS\MsPrint32D.exe
2007-11-02 19:31:33 13152 --a------ C:\WINDOWS\NVDispDrv.exE
2007-11-02 19:31:27 125440 --a------ C:\WINDOWS\system32\xhppcu.dll
2007-11-02 19:29:16 14416 --a------ C:\WINDOWS\GenProtect.exe
2007-11-02 19:29:15 14416 --a------ C:\WINDOWS\system32\k11940028342.exe
2007-11-01 19:28:19 18432 --a------ C:\WINDOWS\system32\k11939163176.exe
2007-11-01 19:28:17 17408 --a------ C:\WINDOWS\system32\k11939163133.exe
2007-11-01 19:28:16 14416 --a------ C:\WINDOWS\system32\k11939163122.exe
2007-11-01 19:28:15 16012 --a------ C:\WINDOWS\system32\k11939163144.exe
2007-11-01 19:23:56 26112 --a------ C:\WINDOWS\system32\kosntc.dll
2007-11-01 17:07:44 16384 --a------ C:\WINDOWS\system32\vdjkbf58.dll <Not Verified; ; Autolive Dynamic Link Library>
2007-11-01 17:07:35 0 d-------- C:\Program Files\symp
2007-11-01 17:07:32 202468 --a------ C:\WINDOWS\system32\drivers\acpidisk.sys
2007-11-01 16:57:31 23040 --a------ C:\WINDOWS\system32\gdvtwx.dll
2007-11-01 16:57:29 17408 --a------ C:\WINDOWS\system32\k11939072683.exe
2007-11-01 16:57:28 14416 --a------ C:\WINDOWS\system32\k11939072672.exe
2007-11-01 16:54:25 16896 --a------ C:\WINDOWS\ekyfgc.exe
2007-10-31 22:40:30 16012 --a------ C:\WINDOWS\system32\k11938414494.exe
2007-10-31 22:40:27 16896 --a------ C:\WINDOWS\system32\k11938414462.exe
2007-10-31 00:16:10 7864320 --a------ C:\Documents and Settings\Administrator\ntuser.dat
2007-10-30 22:03:55 42496 --a------ C:\WINDOWS\system32\SHQ.DLL
2007-10-30 22:03:54 20 --a------ C:\WINDOWS\system32\mhsha1.dat
2007-10-30 20:42:24 16384 --a------ C:\WINDOWS\system32\k119374790215.exe
2007-10-30 20:42:21 30796 --a------ C:\WINDOWS\system32\k119374790013.exe
2007-10-30 20:15:21 16384 --a------ C:\WINDOWS\system32\k119374628015.exe
2007-10-30 01:38:38 16384 --a------ C:\WINDOWS\system32\k119367927815.exe
2007-10-30 00:52:01 5632 --a------ C:\WINDOWS\system32\MJHOOK.DLL
2007-10-30 00:52:01 16384 --a------ C:\WINDOWS\system32\k119367648015.exe
2007-10-30 00:52:01 3072 --a------ C:\WINDOWS\system32\ALMJDLL.DLL
2007-10-30 00:52:01 16384 --a------ C:\WINDOWS\system32\ALMJ.exe
2007-10-30 00:51:59 18944 --a------ C:\WINDOWS\system32\DbgHlp32.dll
2007-10-30 00:51:59 15360 --a------ C:\WINDOWS\DbgHlp32.exe
2007-10-30 00:51:58 27648 --a------ C:\WINDOWS\system32\msccrt.dll
2007-10-30 00:51:58 20480 --a------ C:\WINDOWS\msccrt.exe
2007-10-30 00:51:57 19456 --a------ C:\WINDOWS\system32\MsPrint32D.dll
2007-10-30 00:51:55 26112 --a------ C:\WINDOWS\system32\cmdbcs.dll
2007-10-30 00:51:55 19456 --a------ C:\WINDOWS\cmdbcs.exe
2007-10-30 00:50:53 18944 --a------ C:\WINDOWS\system32\NVDispDrv.dll
2007-10-30 00:50:52 24064 --a------ C:\WINDOWS\system32\MsIMMs32.dll
2007-10-30 00:50:52 18432 --a------ C:\WINDOWS\MsIMMs32.exe
2007-10-30 00:50:50 26112 --a------ C:\WINDOWS\system32\mppds.dll
2007-10-30 00:50:49 25088 --a------ C:\WINDOWS\system32\AVPSrv.dll
2007-10-30 00:50:49 16012 --a------ C:\WINDOWS\AVPSrv.exe
2007-10-30 00:50:48 23040 --a------ C:\WINDOWS\system32\Kvsc3.dll
2007-10-30 00:50:48 17408 --a------ C:\WINDOWS\Kvsc3.exe
2007-10-30 00:50:47 125440 --a------ C:\WINDOWS\system32\GenProtect.dll
2007-10-30 00:50:44 5968 --a------ C:\WINDOWS\system32\MSDEG32.DLL
2007-10-30 00:50:44 3526 --a------ C:\WINDOWS\system32\LYMANGR.DLL
2007-10-30 00:47:41 40960 --a------ C:\WINDOWS\system32\C86728B4.DLL <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
2007-10-30 00:47:39 18989 --a------ C:\WINDOWS\system32\30B9F538.EXE <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
2007-10-29 08:12:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\WZCN
2007-10-29 08:12:36 0 d-------- C:\Program Files\WZCN
2007-10-29 08:12:00 24832 --ahs---- C:\WINDOWS\system32\system.dat
2007-10-26 19:33:45 0 d-------- C:\Program Files\SealOnlineUSA
2007-10-26 19:33:37 65536 --a------ C:\WINDOWS\IFinst27.exe


-- Find3M Report ---------------------------------------------------------------

2007-11-02 20:24:08 502784 --a------ C:\WINDOWS\system32\winlogon(2)(2).exe <Not Verified; Microsoft Corporation; Microsoft? Windows? Operating System>
2007-11-02 20:07:49 0 d-------- C:\Program Files\MSN Messenger
2007-11-02 20:02:36 0 d-------- C:\Program Files\Google
2007-11-02 20:02:10 0 d-------- C:\Program Files\ewido anti-spyware 4.0
2007-11-02 20:02:05 0 d-------- C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor
2007-11-01 21:03:32 0 d-------- C:\Program Files\Steam
2007-09-22 02:01:21 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-09-22 02:00:51 0 d-------- C:\Program Files\LineageII
2007-09-14 15:53:21 0 d-------- C:\Program Files\7-Zip
2007-09-13 22:15:31 0 d-------- C:\Program Files\Scions of Fate
2007-09-13 11:16:56 0 d-------- C:\Program Files\Windows Live Toolbar
2007-09-13 10:11:40 0 d-------- C:\Program Files\Real
2007-09-09 00:42:43 184320 --a------ C:\WINDOWS\system32\KKIgQhmd.dll <Not Verified; ; WebAssist>
2007-09-09 00:02:38 184320 --a------ C:\WINDOWS\system32\612fd7We.dll <Not Verified; ; WebAssist>
2007-09-07 19:11:39 184320 --a------ C:\WINDOWS\system32\paoOFVhn.dll <Not Verified; ; WebAssist>
2007-09-06 13:11:01 184320 --a------ C:\WINDOWS\system32\Y5pyg500.dll <Not Verified; ; WebAssist>


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SnoopFreeUI"="SnoopFreeUI.exe" [09/03/2006 08:48 PM C:\WINDOWS\SnoopFreeUI.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [06/15/2005 05:20 PM]
"GenProtect"="C:\WINDOWS\GenProtect.exe" [11/02/2007 07:31 PM]
"Kvsc3"="C:\WINDOWS\Kvsc3.exe" [11/02/2007 07:31 PM]
"AVPSrv"="C:\WINDOWS\AVPSrv.exe" [11/02/2007 07:31 PM]
"MsIMMs32"="C:\WINDOWS\MsIMMs32.exe" [11/02/2007 07:32 PM]
"NVDispDrv"="C:\WINDOWS\NVDispDrv.exE" [11/02/2007 07:31 PM]
"cmdbcs"="C:\WINDOWS\cmdbcs.exe" [11/02/2007 07:32 PM]
"MsPrint32D"="C:\WINDOWS\MsPrint32D.exe" [11/02/2007 07:32 PM]
"msccrt"="C:\WINDOWS\msccrt.exe" [11/02/2007 07:32 PM]
"DbgHlp32"="C:\WINDOWS\DbgHlp32.exe" [11/02/2007 07:31 PM]
"ALMJ"="C:\WINDOWS\system32\ALMJ.exe" [10/30/2007 08:42 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:54 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"xp_system"=C:\WINDOWS\inet20126\winlogon.exe
"Recoveru systems"=C:\WINDOWS\TEMP\svchast.exe
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [12/14/2004 7:44:06 PM]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [7/11/2005 4:16:25 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [7/11/2005 4:44:20 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"DisableTaskMgr"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"MSDEG32"=LYLoader.exe
"MSDWG32"=LYLoadbr.exe
"MSDCG32 "=LYLeador.exe
"MSDOG32"=LYLoador.exe
"MSDSG32"=LYLoadar.exe
"MSDMG32"=LYLoadmr.exe
"MSDHG32"=LYLoadhr.exe
"MSDQG32"=LYLoadqr.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{267709FD-A691-43B0-BF38-0DF6887A9B44}"= C:\WINDOWS\winpsfisle.dll [ ]
"{27BFC5FD-CF65-4C1A-B2C3-FD508A9FDE51}"= C:\WINDOWS\debug\userMode\F9B394.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070418.dll start"




-- End of Deckard's System Scanner: finished at 2007-11-02 21:02:44 ------------

Relevance 100%
Preferred Solution: Strange pop up keep coming back

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: Strange pop up keep coming back

please ignore this thread.. Have already sent computer to repair as it goes down...

1 more replies
Relevance 67.65%

Hey guys, I'm new here.

I have always had a pretty clean system and never even needed to download hijackthis until today because I had a pesky problem that was annoying me with popup alerts in AntiVir (Vundo...ssttt.dll). So I ran vundofix and a couple other things and it seems to be gone. But now that I've got hijackthis, I noticed something I thought I'd ask about. I see a list of host IP's and banking related sites and such. I have no idea what this is, but I suspected a virus. So I googled and found 9 results, but they were all in German, mostly at the hijackthis.de site. Since my knowledge of germanic languages is "Ja" and "Gutentag", I found no help there, even with the pages badly translated.

So I thought I'd post here, here's the latest log, please let me know what needs to be done.

hijackthis log said:

Logfile of HijackThis v1.99.1
Scan saved at 5:40:10 PM, on 10/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Syste... Read more

Answer:Strange list of IP hosts in hijackthis / How to prevent svcchost from coming back?

6 more replies
Relevance 67.24%

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by SteeL at 16:27:38 on 2011-12-12
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.385.1033.18.4094.2360 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:&#... Read more

Answer:Please help, cycbot.b infection, firewall not working. Some strange proxy settings keep coming back

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/432052 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

2 more replies
Relevance 55.35%

I've been having a a problem with the back left corner hinge since October of last year I poisted to another board about this problem hving been told that this issue would be passed onto support in my region. I'm currious as to weather I'll hear from these people in this lifetime or the next. I enjoy my Laptop and would like to continue using it but as time goes on it keeps seperating more and more and I have to snap it back into place to keep in together. I'm hoping to actually hear back from someone this time that will be able to help me in fixing this issue.

Answer:Back Corner coming from the back left side by the hinge

@jmb1313

 

I have brought your issue to the attention of an appropriate team within HP. They will likely request information from you in order to look up your case details or product serial number. Please look for a private message from an identified HP contact. Additionally, keep in mind not to publicly post personal information (serial numbers and case details).

If you are unfamiliar with how the Forum's private message capability works, you can learn about that here.

Thank you for visiting the HP Support Forum.

1 more replies
Relevance 53.71%

I already posted in How to remove Windows 10 upgrade updates in Windows 7 and 8
In this thread after the starting post from Tookeri other updates that had to be deleted were mentioned. I made a list in post 841
I did not have all these updates on the pc but those that were on it I hid.
Some of them came back and I hid them again.
Now today they are back - with some that I had not seen before.

I made an attachment that shows them and also shows that I hid them again

Will I have to check Windows Update for the rest of my live?????

More replies
Relevance 52.89%

Hello,
I have a problem ,which ive tried to fix serveral times but it keeps coming back.
This virus is located in Systems 32 folder, Pc Cilling 2005 identified it as TROJ_ROOTKIN.N . Ive gone
to safe mode, deleted it, returned to windows and the virus reapeared, wats more it clogs up Pc Cillin, so now under quarantine i have 100+ instances of this virus, and its increasing.
The virus is labelled hpr34k8

Im sure my Hijack Log is fairly clean... -------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 5:27:53 PM, on 14/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Telstra\Toolbar\bpumTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin... Read more

Answer:Virus that keeps coming back and back and back, so on

bump, hopefully someone takes notice

19 more replies
Relevance 50.02%

I am using Windows 8 - Firefox browser. Just recently I have been getting a page up with this address:

http://dft.pathmapping.net/sd/wrap-....net/sd/apps/fusionx/0.0.3.html?aff=1060-8102 when I try to access a web page.

I then have to delete this page and go on to a page I wanted to access. What is this? I've never had this happen in the past - just started today.

Any help to eliminate this would be appreciated.
 

Answer:Strange page coming up

12 more replies
Relevance 50.02%

Hi,
My PC has for a while been making a short brief 'click' noise at random times when it is running. It is the same 'click' that is heard when it first booted up. I am wondering if the hard drive is on it's way out or maybe the fan needs replacing. The noise is not continous and happens maybe a few times a week.

I bought the comp back in 2002 and the specs aren't so happy either:

HP Pavilion 7925
Windows XP Home Edition SP2
AMD Athlon 'Thunderbird' 1,200 MHz
640MB RAM
GeForce 6200 256MB

Everything else seems to be fine, apart from the power loss upon reboot a couple of weeks ago. However the fan did once cause the power to go temporarily when it got jammed but it got fixed.

I don't know if buying new HD and a new OS would be more worthwhile
Maybe it's time to replace her altogether?

Answer:Strange sound coming from PC

I would think the problem could be cause by a broken fan, although I am no hardware expert.

3 more replies
Relevance 50.02%

Hi,I was wondering if anyone might be able to help me here.I have a PC desktop used as a web-server in the office. It was working fine til recently one day when i came to the office early in the morning, i heard a noise coming from the desktop box. The noise, if i can describe, is like the sound of siren in times of emergency. It's not beeping. Honestly, this is my first time i heard the noise like that. Not sure what caused it to trigger that noise and happy if anyone encountered this problem before, might be able to share it with me. BTW, the system is AMD Athlon(TM)XP, 1.61 Ghz, 256M RAM, windows XP Pro.Thank you very much in advance

Answer:Strange noise coming from my PC

Seems like it may be fan related, take the covers off and see if you can pin-point the noise, could be a wire or cable has moved and is touching fan blades

9 more replies
Relevance 50.02%

HII i have dell 1525 inspiron notebook and few days back when i strated it ...it showed blue screen with message physical dump .
now
after that i run the diagnostic test and found that there are some bad sectors on the hard disk bec of which the system is not able to boot properly.

i replaced the harddisk and tried to get my data back from that harddisk
that harddisk is now out and tried to connect it to desktop using sata powercable but the harddisk show both the drives but the files are not accessed and not visible and i am getting the following error .

"unable to mount location DBus error org .freedeskto.DBus.Error.NoReply: Did not receive a reply . Possible causes include : the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. "

so guys tell how to recover my data as it has very imp data in it..
 

Answer:Strange problem coming

me at also
thankx
 

3 more replies
Relevance 49.61%

This is a very weird and rather annoying problem I have. I bought some Insignia speakers about a year 1/2 ago and they worked fine. After moving to a new house, I have very strange music coming from my speakers that sounds like a radio station. In fact, I'm sure it's a radio station and some how the speakers have managed to pick up it's signal and play very very faint music through them.

It has been going on since I moved (4 months) and I just ignored it for the first few months as it was barely audible. Recently, I have purchased some very nice ear buds and use them to play games, but the music is very noticeable and annoying while doing so. If I want to use these headphones for gaming I am going to have to fix this problem.

The music will play regardless of the level of volume the speakers are at. It is very faint and clearly a radio station. What would some solutions to this be? I have researched it somewhat and some people have said keep it away from metallic objects or something of the sort that could attract radio waves. Well, my computer is the exact same setup as it was at my previous address which gave me no problems.

If I bought different speakers could I expect the same thing? Any help would be appreciated as this is a very annoying problem.

More replies
Relevance 49.61%

I noticed twice a strange noise coming out of my Satellite L40
About one or two seconds there was a sound that sounded a bit like the noise that you hear when you use a analog dial up modem and are trying to connect.

It came out of the blue and I am using a wireless ADSL connection.
The sound of my notebook was off.

Does anyone noticed the same thing or do you know what it could be?

Answer:Strange noise coming out of my Satellite L40

I have the same strange noise. It happens sometime like you said - out of the blue. It sounds like dial-up modem but I also have a feeling it sounds like a hard disk with a problem - something clicking for a second or two (it's a brand new notebook that I bought about 40 days ago and I don't do any heavy work on it - some typing, Internet browsing and such things.

I would also want to know what is it. Especially if it can harm my data some day...



PS Why this strange message for registered users?
"Please note, your reply will need to be approved by a moderator before it is posted in the forum."

2 more replies
Relevance 49.61%

Hello all,

When I start up GTA IV (purchased through Steam) on my PC, there is a high-pitched whining noise coming from my PC. I've tried to open up the side panel while this is occurring to try and narrow down where this noise may be coming from. I'm still not a 100% sure, but my best guess at the moment is my GPU. I've tried cranking down the Graphics but that doesn't change the noise at all. And the second I switch back to my desktop (even if the game is still running) the noise goes away.

I ran FurMark in bench marking mode to stress-test the GPU. The noise isn't quite the same during that test, but it is close. The only difference is, during that test, the pitch of the noise changes going up and down every few seconds. When I play GTA IV, the noise is present while the game is loading and for the first minute or so while playing. It appears to go away after that point and may return occasionally after that.

Does anyone have any idea what this noise is and how I can stop it? I've done some research online and a few people have mentioned coil-whining. Could this be the cause? I'd sure appreciate any help on this one.

EDIT: I should also mention, this is a problem that has arisen over the last 2 or 3 days. I don't recall hearing this noise when I first installed GTA IV and tried it out (probably 3-4 weeks ago).

Here are my system specs:

CPU: Intel Core i7-4770K 3.5GHz Quad-Core Processor
CPU Cooler: Corsair H100i 77.0 CFM Liquid CPU Cooler
Motherboard: ASRock Z87 ... Read more

Answer:Strange noise coming from PC when I play GTX IV

What have you changed in the last few days? How old is your PSU?

I have that happen to me all the time when I load up certain games. Mine is the GPU's spinning up to handle the game. No biggie (to me that is) as it's not going to hurt your GPU as long as the fans kick on when a load is put on it. I also have a fan controller, so I can push extra air around my cards when I'm playing as well.

8 more replies
Relevance 49.61%

Hiya, i have a HP pavillion notebook (dv1355EA) for well over a year now but in this last month ive heard a mosquito type noise coming from my speakers. The noise comes on and off but is getting more frequent, i either have to wait for it to stop or mute my speakers to get it to stop. It sometimes comes on slightly before the fans start up and stops when they stop, but sometimes the fans work without the noise.

It plays over any music or DVD i play but have noticed that it doesnt make the noise if i use the Quickstart Dvd without loading up windows. Have also at times noticed the hard drive loading noise coming through the speakers aswell which can be stopped by switching my speakers off.

Have reloaded all the original drivers and restarted a number of times but its still there. Have even tried to hoover out the fans to remove any dust i could. I was thinking that maybe the sound card is damaged in some way of that its maybe overheating, but im all out of ideas as the noise is still there. Any help would be greatly appreciated, thankyou!!
 

Answer:Strange noise coming from laptop..

Sounds like perhaps the switching P/S is being coupled into the sound. If it just started happening, it could be lose screws/shielding in the laptop causing the issue. It could also be one of the fans dying, since DC brushless fans can generate such interference if they're failing.
 

1 more replies
Relevance 49.61%

I'm going to try to explain this the best I can. Anytime my computer is doing something, (sounds like it's only from a select number of programs) I can hear a weird low volume (but still very noticeable) screeching noise that gets higher in pitch. It only lasts about 3-4 seconds and sometimes happens again immediately. Sounds like it's either the HDD or...network traffic. (I know it sounds weird.) For example when updating Avast antivirus definitions. Anyways here's my specs if they help.

Asus K8N-VM Micro ATX Mobo
AMD Sempron 2600+ 1.6Ghz Single Core CPU (Socket 754)
1GB DDR RAM
320GB WD Caviar Blue HDD
Nvidia Geforce 7600GS (PCI-E)
Windows XP Home Edition

Don't worry I'll be upgrading all this soon, (except for the HDD) it's just that I don't have a job and I'm a little short on money (Upgrades would cost about $350.00 off Newegg.)

Answer:Very strange sound coming from computer

to Bleeping Computer, sjvirchow.

I've experienced something similar to this before on my Mom's old Acer laptop...if you had the wireless turned on and closed the lid, it would make this high-pitched noise...turn off the wi-fi, doesn't do it. It appeared to be some sort of interference between the wireless card and some component of the lid.

This may or may not be the same thing you are experiencing.

I doubt it is the hard drive, in your case...a hard drive making that kind of noise could not function for long without blowing up.

Is the sound coming out of the speakers or can you narrow it down to a particular place around the case? Try turning off various components, and see if you can narrow down what could be causing it.

Could it be caused by your fan(s)? Try thoroughly blowing out the case with a can of compressed air.

15 more replies
Relevance 49.61%

Hey guys,

Basically, occasionally when I open up a tab in google chrome, I get this weird alien noises from my speakers. Its at 100% volume and loops until i close that tab.

In the sound tray, it says it is coming from chrome. I have no extensions or anything like that in Chrome, and I have done a virus search with norton 360 without much help. Any ideas?

It can be quite annoying late at night when i get this incredibly loud sound coming through, it sounds like an alien mothership or something like that.

If you guys need any info on my computer, just shout

Thanks for any help at all

Charlie
 

Answer:Strange noise coming from speakers.. help?

Download and save DDS to your Desktop from either of the following links:

http://download.bleepingcomputer.com/sUBs/dds.scr
http://compendiate.net/sUBs/dds/dds.scr

Double click DDS to run the scan, Vista or Windows 7 user accept UAC alert.
There will be an alert that two logs will be saved to the Desktop, DDS.txt and Attach.txt
Copy and paste those two logs to your reply when the scan is complete....

Kevin....
 

3 more replies
Relevance 49.61%

I have Windows XP Professional SP3 Version 2002

HDD Seagate with 7200 rpm, 8 MB Serial ATA
ATI Radeon PCI-Express, x550, 256 MB DDR(128 bit)
Pentium 4 CPU 3.00 Ghz, bus 800, s.775, 1 mb, 64 bits
Intel 915-P, s.775, FSB 800, Serial ATA, PCI-E, Dual DDR400, ATX, GA - 8i915pl-g.

The problem is like that : I get a super-scarry sound coming out from my hardware parts, not from my sound system. It's like the sound of the computer when you press multiple keyboard buttons, but this sound is louder and longer[5-6 secs] and appears when I play Tomb Raider. I played it before, but no problems. Recently i installed myself a 512 Ram, and there started the sounds, i guess... Should i ignore them ? Or not to play anymore ? My PC will break?

I probably should buy another fan, but i visited some profile-sites, and there are lots of fans. For CPU, for one, for another...I don't know what to buy, if i should buy one... :-??
 

Answer:Solved: Strange noise coming from nowhere...:-??

The sound is probably coming from the internal speaker of your computer. This is a way for your computer to "complain" about something, to report a problem.

Open your case and try locating the sound source. Internal speakers are usually mounted on the case and connected to the motherboard. If you can't locate a speaker, look for a small rubber-like cylinder object, this could be the speaker as well.

Now, if you are sure that the sound comes from the speaker, we must identify the error code (aka the sound). Check the manual of your motherboard, you can usually find details regarding BIOS error codes there...Or try the manufacturer's website.

Upgrading RAM can cause problems. However, in that case you wouldn't be able to start your computer at all or you would be getting other error messages as well (like the infamous Windows Blue Screens of Death)...

IMO, your computer complains about overheating since the sound starts when you run games. You may accidentally moved the CPU heatsink while installing the RAM stick, who knows? Next time you hear this sound quit the game, restart and enter the BIOS in order to check the CPU temperature.

You can enter the BIOS by pressing a certain key (usually the DEL key) while the computer boots up. You will see a message like "Press DEL to enter Setup" on the POST screen, the first screen that appears when you start your machine, where information about your CPU, RAM and drives is displayed.

Once in th... Read more

1 more replies
Relevance 49.61%

I am having unusual noises coming from my computer, like I am frying a steak or something. It's not very loud and strong but its continous since about an hour ago. I tried restarting but it came back. Any possible suggestions please?

Answer:Strange noises coming from computer

HDD Clappered,Or even a fan....But ensure its not the hdd first.Remove the internal power cable from the HDD, and see if it is quiet.

10 more replies
Relevance 49.61%

I've managed to get rid of a lot of trojans and viruses during the post two days but there is only one thing left. I have no clue how to get rid of it at all and it just seems to be adware but it gets blocked each time by Malwarebytes. I really need help now as its starting to get really annoying and I feel unsafe actually using my computer because of it.
http://imgur.com/mvs8uKV Link to what it looks like.
 
Anyway my FRST notes.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-12-2015
Ran by Jake (administrator) on JAKE-PC (31-12-2015 00:21:05)
Running from C:\Users\Jake\Downloads
Loaded Profiles: Jake & DefaultAppPool (Available Profiles: Jake & DefaultAppPool)
Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(... Read more

Answer:Strange adware coming from regsvr32.exe

bump

11 more replies
Relevance 49.61%

When I just press the start button in CPU and when it starts sometimes a sound comes from it..previously also a sound used to come.... the sound of fan but recently its making loud sound... all the other things are fine. i can use my PC normally but the sound is worrying me.... . most probably its the sound of the fan.... but why does it make so loud sound sometimes?? its not that it always happens but when it does it makes me afraid... please help
 

Answer:Solved: Strange sound coming from CPU?

16 more replies
Relevance 49.61%

I keep seeing this error message pop up every half hour or so(picture below). I searched my pc for a program called playto and I found some game program and uninstalled it assuming it would solve them problem, but that didnt help. I'm not sure what this message means. It looks like some program is trying to update and it cant find the updater.dll. I dont know how to fix this though. If anyone has any suggestions please help.

C:\Users\Owner\AppData\Local\PLAYTO~1\Updater.dll

Answer:Strange Error Message Keeps Coming Up

Open Windows Explorer. Press Alt, click View. Put a check box in Show Hidden Items
Browse to C:\Users\Owner\AppData\Local is there a folder named PLAYTO if so, right click and Delete it.

6 more replies
Relevance 49.61%

I JUST got highspeed yesterday, and upon loading up my computer this morning I got a strange message during startup. I hit printscreen, and here's what I saw:

A black box on my desktop, with the heading:

C:\PROGRA~1\INTERN~2\UPDATE\OPTIMI~1.EXE

Nothing was written in the box.

But a message box came up saying:

Heading:
16 bit MS-DOS Subsystem

And then:

C:\PROGRA~1\INTERN~2\UPDATE\OPTIMI~1.EXE
The NTVDM CPU has encountered an illegal instruction
CS: 0537 IP: fff5 OP: ff f8 ff fa ff Choose close to terminate the application.

What is this, and how can I get rid of it?

Also, when I turned on my computer I had a strange new feature on the internet explorer address bar, and something called 180searchassistant or something like that (I removed it using add/remove programs, but I don't think I had it last night).
 

Answer:Strange screen coming up on startup

6 more replies
Relevance 49.61%

so...
i have a problem with my 'hdd2' i think i have Qosmio G20-127
it all started yesterday ... and now its like this (http://www.youtube.com/watch?v=D3Pzea1xMR8) this noise is making me sic.

Please help me and tell me what to do to get rid of it...

thanks.

Answer:Qosmio G20-127: very strange noise coming from HDD

if you are shure, that the noise comes frome the hdd, i would strongly recommend to save all your data. it's mostly a indication that the hdd will break down... then you should contact a service partner, to check the whole unit. he is able, to find out, if the noise is related to the hdd and if necessary, to take the next steps.

br, Ben

2 more replies
Relevance 49.61%

Sometimes when I use my computer, a strange kind of whirring sound starts to happen. It will go away if I move my computer but im not really sure why its happening or what it is. I've noticed a performance loss since this has happened. Anyone know what it is and how i can fix it?

Answer:strange sound coming from computer?

I would suggest opening the cover and trying to isolate where the sound is coming from.Someone in the past reported a similar problem, but I think he said his computer "glowed" also.

1 more replies
Relevance 49.2%
Question: Keeps Coming Back

Can someone please help me with this problem? All my AV programs detect a virus running in my system, but whenver I have it removed, it keeps coming back How can I stop this???


HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:22:13 AM, on 8/25/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Nexon\Mabinogi\npkcmsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\csrcs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.... Read more

Answer:Keeps Coming Back

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

---------------------------------------------------------------------------------------------

If you still require assistance with this issue, please do this:
Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool and click Continue at the disclaimer.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt here.
Please attach info.txt to your post.
To attach a file to a new post, simplyClick the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
copy and paste the following into the "Upload File from your Computer" box:C:\rsit\info.txt

Click Upload.

---------------------------------------------------------------------------------------------

2 more replies
Relevance 49.2%

I uses Vundofix, ad-aware, spybot, xoft, avg, House call, Microtrend, Don't know what to do next? here is my infoLogfile of HijackThis v1.99.1Scan saved at 1:48:37 PM, on 3/22/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\NavNT\defwatch.exeC:\Program Files\NavNT\rtvscan.exeC:\Program Files\Norton Utilities\NPROTECT.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\NavNT\vptray.exeC:\Program Files\BearShare\BearShare.exeC:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.htmlO4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\... Read more

Answer:Pop Up's Keep Coming Back

Hello Mhenry, Welcome to BleepingComputer!My name is Nick and I will be checking over your log.Let's get started.You will want to print or save these instructions.Please download Look2Me-Destroyer.exe to your desktop.Close all windows before continuing.Double-click Look2Me-Destroyer.exe to run it.Put a check next to Run this program as a task.You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OKWhen Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.Once it's done scanning, click the Remove L2M button.You will receive a Done Scanning message, click OK.When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.Your computer will then shutdown.Turn your computer back on.Please post the contents of Look2Me-Destroyer.txt (it can be found wherever you saved Look2Me-Destroyer.exe) and a new HiJackThis log.If Look2Me-Destroyer does not reopen automatically, reboot and try again.I highly suggest you get rid of BearShare. It is a P2P program which is usually the cause for malware.Read here for more information on clean and infected File Sharing Programs.Click Start> Control Panel > Add/Remove Programs and remove:BearSharePlease note any other programs that you dont recognize in that list in your next responseReboot your computer once more.Please go HERE to run Panda's ActiveScanOn... Read more

1 more replies
Relevance 49.2%
Question: keeps coming back

I keep running scans and it cleans the computer sometimes. I will encounter xp antispyware 2009 and 2008 telling me that my computer is infected. It posts a permanent box on my desktop saying infected and keeps popping up at bottom right by time clock saying infected. I will run anti malwarebytes and it will clean it only if i do quick scan. But then i will run full scan and it freezes so i know it is still infected. And sure enough a few days later it is all back. Please help. I also run cc cleaner and norton but norton freezes too. I have also tried in safemode but still freezes. Thanks Any and all help is greatly appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:21 PM, on 10/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Inte... Read more

Answer:keeps coming back

bump
 

2 more replies
Relevance 49.2%

I have a PC i believe is infected.
i have run Combofix, it appears to find something and reboot but i am unable to tell by the log what it found.
i think it is still infected because if i run CF again, it says it needs to reboot to continue.
 ComboFix.txt   29.88KB
  5 downloads
 ComboFix2.txt   30.15KB
  3 downloads
 ComboFix3.txt   26.11KB
  2 downloads
 ComboFix4.txt   29.75KB
  3 downloads

Answer:it keeps coming back

Hello cgtrott, I will be handling your log to help you get cleaned up. I apologize for the delay but the forum is very busy and as you can see the logs we ask for are very extensive and take a lot of time to investigate. Please subscribe to this topic. Click on the Watch Topic button, select Immediate Notification and click on proceed.Make sure Word Wrap in notepad is turned off. When copying and pasting logs paste them directly in the reply box only attach logs if asked to. Do not wrap logs in codebox or code tags. It makes it very difficult to read and analyze them. Please paste them directly into the reply box. Do not make any changes to your system until we are through. Fixes are based upon information that is current from your system so any changes can affect our strategy. Please refrain from running any tools we may use without specific instructions.If your operating system is Windows Vista or Windows 7 it may be necessary to right click then choose Run as Administrator any programs we use.Before we begin please check and follow the instructions on How to Show Hidden Files and Folders in Windows Vista and Windows XP and How to show hidden files in Windows 7Because the e-mail notification system is not completely reliable, please check your topic once a day for responses.Please read carefully all directions and instructions. If you are instructed to save a tool to the desktop please save it to the desktop. If you have since resolved the original problem you were ha... Read more

2 more replies
Relevance 49.2%

Hello, after removing numerous malwares, str.sys keep coming back even though i removed it several times.Here's the log, thanks for your help.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:22:19 PM, on 7/16/2009Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v7.00 (7.00.6001.18000)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\system32\taskeng.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Toshiba\Utilities\KeNotify.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Symantec AntiVirus\VPTray.exeC:\Windows\System32\hkcmd.exeC:\Windows\System32\igfxpers.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Synaptics\SynTP\SynToshiba.exeC:\Windows\system32\igfxsrvc.exeC:\Windows\ehome\ehtray.exeC:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exeC:\Program Files\Symantec AntiVirus\DoScan.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program... Read more

Answer:Str.sys keep coming back, help!

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

2 more replies
Relevance 49.2%

Hi everyone,

i had this fake FBI Virus on a laptop couple days ago, it would not let the windows to boot, not even in safe mode. i got it to clean with kaspersky boot disc, and also scanned it with avg, malwarebytes, avast. send it back to customer, same night he called me saying avast kept picking up something but was not able to remove it! so i picked it up again the next day, scanned with avg & malwarebytes seemed to be cleaned up again, nothing was picking up any viruses. but guess what? this morning i have a text from a custoemr, saying he was locked up out of screen and he was able to get into it, but now avg is picking up something again!!! i asked him if he uses usb drive or external or anything but he said he did not use any of those! PLEASE HELP WITH REMOVAL OF THIS!!!!

Answer:It keeps coming back!!!!

Hello sapikest,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.
First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Before we start, please note:

Please be advised that this free service is typically for home users. We'll help you out this time, but in the future if you are unable to clean a machine via standard methods, then either backup the client's data and rein... Read more

2 more replies
Relevance 49.2%

Hello
For many years a succeeded in keeping my computers safe - then, not even a month ago, something surfaced. A Virut thing after I visited an insecure site.
If this can help, a few days before I had for the first time in my pc life installed a downloader program called Flashget-
Well I tried at first to clean up with Spybot and Spyware Doctor (who had not by the way intercepted the hostile item). But the machine had still a strange behaviour so I downloaded some Linux based Rescue CD .iso files (Kaspersky, BitDefender, WebDoctor), burned the CDs and went on scanning without Windows. Those found a wealth of infections by Trojans as well as by the Virut thing, so I kept cleaning and cleaning (desinfecting and/or deleting that is) until nothing more was found.
I then restarted Windows, uninstalled Flashget and installed Avast antivirus. Unfortunately when using my browser I started to get redirected to a "stolnik.net" whatever search I did. Plus Avast began to show infections spreading in the system by a "W32.Vitro" virus. So I tried again with the rescue CDs - Kaspersky found a couple issues but nothing else - and Avast still claiming I have the W32.Vitro everywhere.
At this point I used the VirutCF removal tool by Norton, but to no avail - there is no Virut infection in the machine.
I was beginning to get nervous so I downloaded the Combofix tool, disabled all and every anti-virus and -spyware - as requested - and tried to start Combofix: nothing happens... Read more

Answer:They keep coming back

If you truley have Virut the only real alternative is to do a complete wipe and reinstall. See boopme's post here:http://www.bleepingcomputer.com/forums/ind...t&p=1260380That will help you determine if you have virut, and if you do, what you need to do.

13 more replies
Relevance 49.2%

I am trying to clean out a co-worker's computer. I have restored to over a month ago and continue to find malware during scans. Any help appreciaded. Have not yet restarted to fully remove. Do I need to kill some files will killbox prior to the restart? Thanks, Jeff

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3930

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

3/31/2010 2:19:22 PM
mbam-log-2010-03-31 (14-19-22).txt

Scan type: Full scan (C:\|)
Objects scanned: 231065
Time elapsed: 1 hour(s), 11 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Windows\System32\config\systemprofile\AppData\Roaming\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.

Files Infected:
C:\$Recycle.Bin\S-1-5-21-2658977195-169558386-357108580-1000\$RR7NTAN.tmp (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\avp.ico (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Wi... Read more

Answer:ave.exe keeps coming back

Windows restarted for updates while sleeping last night. Running malwarebytes again. Final rid of Hijackthis entries
O20 - AppInit_DLLs: C:\ProgramData\nuvanifi\nuvanifi.dll
2658977195-169558386-357108580-1000

Malwarebytes came out clean as well as a full McAfee virus scan. Hijackthis log appears clean too. With persistance I think I have this cleaned finally. I have both a dds scan and gmer report but don't really know what to look for. I can post these if someone has time to review them. I ran both prior to the windows update restart. Also updated and ran spywareblaster. Pop ups and redirects are gone too.

Partial log of items cleaned.
3/31/2010 2:19:22 PM
mbam-log-2010-03-31 (14-19-22).txt

Folders Infected:
C:\Windows\System32\config\systemprofile\AppData\Roaming\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.

Files Infected:
C:\$Recycle.Bin\S-1-5-21-2658977195-169558386-357108580-1000\$RR7NTAN.tmp (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\avp.ico (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
C:\Windows\System32\co... Read more

1 more replies
Relevance 49.2%

Everytime I run webroots spysweeper It finds a cws threat. I don't understand why it keeps popping up, even after I tell spysweeper to remove it. Someone want to help me....

Logfile of HijackThis v1.99.1
Scan saved at 7:44:30 PM, on 10/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\programfiles\Spy Sweeper\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Eset\nod32kui.exe
D:\programfiles\Spy Sweeper\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
D:\programfiles\MicrosoftAntivirus\gcasServ.exe
C:\Program Files\QuickTime\qttask.exe
D:\programfiles\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\programfiles\MicrosoftAntivirus\gcasDtServ.exe
C:\Program Files\LIUtilities\WinTasks\wintasks.exe
D:\programfiles\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.... Read more

Answer:CWS keeps coming back

8 more replies
Relevance 49.2%

Can't seem to get rid of the trusted zones, option is disabled in internet tools. I've run spybot, adware and avast but they still show.

Logfile of HijackThis v1.99.0
Scan saved at 10:18:03 AM, on 2/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.... Read more

Answer:they keep coming back!

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer. After we are finished with your log file and verified that it's clean, you may turn it back on and create a new restore point.

Right click on this link http://www.greyknight17.com/spy/De... Read more

3 more replies
Relevance 49.2%

Here is my dilemna:

I've run Kazaabegone, CWShredder, Spybot and Adware with new updates and reboots in between. I've run Hijack This and removed what I knew to be suspicious files in safe mode. But one:

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

keeps reappearing on the HJT log after rebooting. I know I'm missing something; just don't know what.

Here is the entire log:

Logfile of HijackThis v1.97.7
Scan saved at 8:04:28 PM, on 2/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\EarthLink 5.0\Con... Read more

Answer:New.net keeps coming back

6 more replies
Relevance 49.2%

okay, so yesterday i cleaned my pc with "malwarebytes anti-malware and there were like 11 viruses. then i scanned after t, none, so i get up this morning and scan my pc because everything is going SO SLOW! and now i got 10 viruses. can anyone please help? yesterday i had like 2 injections, 2 clickers, 2 malware.packs, and like 6 agents.
heres my log for yesterday: http://pastebin.com/panEZfVS
and heres todays: http://rhymingcolors.pastebin.com/G7gJ51nr
please help. 5 of those kinds ive never seen before :/ please comment below
 

Answer:they keep coming back >:(

8 more replies
Relevance 49.2%

This is my second attempt at help. I failed my first time and after reading the preparation guide here I am. I tried fixing it myself and loading MBAM and it says I have an infected regestry value, (Trojan.Agent) When I run the MBAM it says my computer must reboot to fix. It does, but then I have the same infection. I am confused, frustrated, and not really sure now what I am doing. Thankfully there are those here that can help...I am humbled.

Here is my DDS.txt
DDS (Ver_09-03-16.01) - NTFSx86
Run by Owner at 16:10:46.34 on Tue 03/31/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.186 [GMT -4:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
C:\WINNT\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\ezSP_Px.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINNT ... Read more

Answer:Not sure what I have...but it keeps coming back

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Please post the contents of log.txt. Thank you for your patience.Please see Preparation Guide for use before posting about your potential Malware problem. If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped. Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so. While we are working on your HijackThis log, please: Reply to this thread; do not start another! Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so. Do not run any other tool until ... Read more

2 more replies
Relevance 49.2%

I have a problem with pop-up ads that keep on appearing randomly on my computer. I tried using adaware which picked up a lot of them, but they keep coming back later.

Hijack this log (Created with Hijack-this Analyzer)

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 4/1/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Fil... Read more

Answer:Pop-Ups that keep coming back

Hi and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p

Please be patient with me during this time.

4 more replies
Relevance 49.2%

Hot bar I am told is a parasite.That is its a freeby thats seems frindly but in reality is sucking all your secrets.So last night I deleted all trace of it from the system by norton and by Regedit.Tonight it back......What sort of mallet this this need ?

Answer:hot bar keeps a coming back

Please post a HJT log click hereYou may need to post in in two halves because of the 800 word limit.Please double space it by adding a blank line after each line so that it is legible with the site's formatting.

4 more replies
Relevance 49.2%
Question: Keeps coming back

Ok guys not sure what I keep missing but the 020 line keeps coming back and changing it name.

I have ran CWS, ewido, Killbox ( and delete after reboot) VirtumundoBegone
Logfile of HijackThis v1.99.1
Scan saved at 11:25:30 AM, on 1/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hijack This\TrojanHunter 4.2\THGuard.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDae... Read more

Answer:Keeps coming back

10 more replies
Relevance 49.2%

I have done everything to get rid of my recent popups including runings spybot, adaware, microsoft Antispyware, Norton and Pandascan both in regular mode and safe mode. THey keep on finding stuff, but after restarting, they still come back. I have also empties the TEMP folder and cookies and temporary Internet files. I have included a HIJACK this log, hopefully someone can help. thanks.

Logfile of HijackThis v1.99.1
Scan saved at 6:34:55 PM, on 6/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\GWHotKey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe... Read more

Answer:HJT Log because they keep coming back

16 more replies
Relevance 49.2%
Question: Back coming off?

My Lumia 640 is quite new and the back plastic panel writing logo is coming off the Microsoft logo has come off and some letters are coming away?
Is this normal?

More replies
Relevance 49.2%

I think I may have finally scrubbed enough to keep the dll (IeBHOs.dll) from re-appearing, but the E2G folder keeps recreating itself. Any suggestions?

It's a friends system and had Norton on it. I installed NOD32 and PC Tools Spyware Doctor. Then read a few threads and ran HJT a few times and made some deletions that "may" have helped. I know that I managed to get rid of the TrojanDownLoader-AC2 but this E2G is stubborn.

Also ran SpySweeper many times in safe mode and in non-safe mode. Disables Spyware Doctor from auto load with windows as it seemed to be interefering with the Spy Sweeper scan.

Here's the latest HJT log:

Thanks in advance for any suggestions!

Charlie

Logfile of HijackThis v1.99.1
Scan saved at 6:51:15 PM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:E2G keeps coming back

Three threads are not needed for the same problem.
 

2 more replies
Relevance 49.2%

Oh God help me... these anti-spyware pop ups keeps popping up and i always run a check on ad-aware 6 and Spybot once i see it. But once i connect to the net and open a site, it all comes back again n i haf to scan it all over again.... help please this is real miserable...

Thank you.

Answer:It just keeps coming back...

try manually removing, on www.doxdesk.com there are listings for spyware/parasites.

you could also go to run > msconfig and deselect any programs starting up that you dont recoginse.

also try going to http://www.symantec.com/homecomputing/
at the bottom is a link to a free online virus check, you may have one that persistantly downloads spyware.

and finally ensure you have a firewall and if you have one make sure its up to date. www.download.com has a free copy of zonealarm, thats a good one

6 more replies
Relevance 49.2%

I think I may have finally scrubbed enough to keep the dll (IeBHOs.dll) from re-appearing, but the E2G folder keeps recreating itself. Any suggestions?

It's a friends system and had Norton on it. I installed NOD32 and PC Tools Spyware Doctor. Then read a few threads and ran HJT a few times and made some deletions that "may" have helped. I know that I managed to get rid of the TrojanDownLoader-AC2 but this E2G is stubborn.

Also ran SpySweeper many times in safe mode and in non-safe mode. Disabled Spyware Doctor from auto load with windows as it seemed to be interefering with the Spy Sweeper scan.

Here's the latest HJT log:

Thanks in advance for any suggestions!

Charlie

Logfile of HijackThis v1.99.1
Scan saved at 6:51:15 PM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:E2G keeps coming back

Thread closed, please do not post duplicates!
Continue here: http://forums.techguy.org/security/460316-e2g-keeps-coming-back.html
 

1 more replies
Relevance 49.2%

I think I may have finally scrubbed enough to keep the dll (IeBHOs.dll) from re-appearing, but the E2G folder keeps recreating itself. Any suggestions?

It's a friends system and had Norton on it. I installed NOD32 and PC Tools Spyware Doctor. Then read a few threads and ran HJT a few times and made some deletions that "may" have helped. I know that I managed to get rid of the TrojanDownLoader-AC2 but this E2G is stubborn.

Also ran SpySweeper many times in safe mode and in non-safe mode. Disables Spyware Doctor from auto load with windows as it seemed to be interefering with the Spy Sweeper scan.

Here's the latest HJT log:

Thanks in advance for any suggestions!

Charlie

Logfile of HijackThis v1.99.1
Scan saved at 6:51:15 PM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:E2G keeps coming back

16 more replies
Relevance 49.2%

windows securty 7 keeps coming bak after doing all the steps
 

Answer:it keeps coming back

Please attach the logs from both SUPERantispyware and MalwareBytes. Also run the below and attach the log.

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run
 

11 more replies
Relevance 49.2%

Hey everyone this is the first time I have posted anything but i am having some serious problems. I let my brother borrow my laptop and when i got it back it was infected bad.
I have pc-cillin, Malwarebytes, and SuperAnti-Spyware.
SuperAnti-Spyware seems to clean everything after i scan and reboot but there are two things that keep coming back on the next re-boot.
1. Pc-cillin keeps giving me a waring telling me to close the browser when its not open with the web address of 110/rjsa/select.php?a=6707a0a cd82d9318fa98c6ee396eed8e61fcf4200553e0c95d8b1d81bbda3c1b&b=1001&c=1
2. There is a sys32 file that gets deleted and always comes back on reboot its MoIXWA40.dll
Pc-Cillin tells me this is a trojan.bho and says its will delete on reboot.
please help me this is so frustrating it slows everything down sooo slow.
 

Answer:Pop-Ups keep coming back

Hi, Welcome to TSG!!
Click here to download HJTInstall.exe

Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

 

1 more replies
Relevance 49.2%

2 nights ago i was surfing the next and i starting getting reports such as :

Windows has detected spyware infection!
It is recomended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you
Click here to protect your computer from spyware!

and

Warning! Potential Spyware Operation!
Your computer is making unauthorized copies of your system and
Internet files. Run full scan now to pervent any unathorised access
to your files! Click here to download spyware remover ...

i started getting a lot of popups trying to send me to a site calling cookingluck (f3.cookingluck.com, f5.cookingluck.com, f7.cookingluck.com,
f9.cookingluck.com) i close them before they can finish loading.

Now i didnt do the smartest thing and i downloaded one of the "anti-spyware" things they told me too. "system-defender". well thats about when everything went from bad to worse, shell.dll was giving me hell, wowfax.dll was messing up. The control panel icon also disapeared and anything i tried to do with the system it wouldnt let me..pretty much telling me i didnt have administrative privliges.

So i came on this site and saw the self help page and was looking it over and saw the the "SmitFraud and It's Variants Removal Instructions" section fit my problem to a T, so i followed the steps exactly as they are written. I also got rid of the system defender. When i rebooted into norma... Read more

Answer:It just keeps coming back.....

Hi and welcome to TSF.

My name is Iain and I will be helping you clean your system.

You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your logs are clean. Remember that although your symptoms may vanish, this does NOT mean that your system is clean.

If there is anything you don't understand, please ask BEFORE proceeding with the fixes.

Please ensure that you follow the instructions in the order I have them listed.
We'll begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix
When the tool is finished, it will produce a report for you.
Please post C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

NOTE: Combofix prevents autorun of all CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.

12 more replies
Relevance 49.2%

I can't get rid of this crap - I've ran everything on here that people say. I have SAV installed and up to date, I have SpywareGuard installed, I have ran HJT, I've ran Ewido software, nothing can get rid of this - Everytime I clean everything while in Safe mode and reboot, Spywareguard immediately starts popups saying a BHO has been added (suchs as C:\WINDOWS\system32\wvuvspq.dll) - I click remove BHO, and it comes back over and over...

Someone please help - this has totally destroyed my computer...
 

Answer:Someone please help - These BHO's keep coming back!!

Closing duplicate thread. Please continue to reply here: http://forums.techguy.org/malware-removal-hijackthis-logs/648572-please-help-my-hijackthis-log.html
 

1 more replies
Relevance 49.2%
Question: Keeps coming back!

I thought I wiped it off already but it's back AGAIN! And my SpyBot S&D is missing all sorts of components so it's not working right and it's the only one that has found any. The Microsoft one found one and deleted it but SpyBot found 16 but only deleted 2 before running into problems. EliteBar is back also. Help again!
 

Answer:Keeps coming back!

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
After doing ALL of the above you still have a problem:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
 

3 more replies
Relevance 49.2%

I am having trouble getting rid of this BHO object.Everytime I manage to remove the dll and the BHO registry entry it comes back under a different name.I have run Spybot, AdAware and Trend Micro AV.Any help would be appreciated.Logfile of HijackThis v1.99.1Scan saved at 3:17:14 PM, on 04/16/07Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exeC:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exeC:\WINDOWS\system32\fxssvc.exeC:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exeC:\WINDOWS\TEMP\EWE594.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files ... Read more

Answer:Bho Keeps Coming Back

Hello EBurritt, I am SifuMike and I will be helping you. Disable your antivirus program and go here http://www.bitdefender.com/scan8/ie.html and run an online scan with BitDefender (you will need to use Internet Explorer for this scan). When the ActiveX Control has loaded, click on "Click here to scan". Please be patient, as this scan may take a few hours. It all depends on the number of files on your computer. When BitDefender completes the scan, select the "Detected Problems" tab. Click on "Click here to export scan". Save the file as an HTML to your Desktop. Then click on the saved file and allow it to open with your browser. Go to Edit - Select All then copy/paste that log back here. Post the BitDefender log.******************Download ATF (Atribune Temp File) Cleaner? by Atribune DO NOT run it yet. Download and install AVG Anti-Spyware 7.5 (formerly Ewido) This is a 30 day trial of the programAVG Anti-Spyware is designed to be used to both scan for and remove malicious files and also to run in real-time alongside, but not replace, your existing anti-virus program to give an added layer of protection.Both the Resident Shield and Automatic Updates will only be available for the thirty day trial period, after that AVG Anti-Spyware will revert to a stand-alone scanner which you can keep and manually update for free and use in a similar way to Ad-Aware SE Personal, Spybot S&D etc.1. After download, double click on the file to launch the... Read more

11 more replies
Relevance 49.2%

I've run Ad-awareSE, Trend Micro's housecall, and McAfee. I've also run Ad-aware while in safemode yet I still keep getting these popups and McAfee keeps telling me that " The file C:\\WINDOWS\system32\winupdt.exe was infected by the Downloader-LG trojan and has been deleted to complete the cleaning process. Its' says it repeatedly then stops then a few hours later it'll come back. Here is my Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 6:07:30 PM, on 3/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wkogyo.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:... Read more

Answer:They just keep coming back...

16 more replies
Relevance 49.2%

Greetings everyone I need some help.

First off... I have followed all the proceedures listed on the READ ME thread that is asked and I STILL AM HAVING ISSUES.

I have Ad-Aware SE and with the VX add.

I have HiJackThis v1.99 and have followed the steps on that thread as well.

Here is the problem:

I run Ad-Aware everytime I log on, and even in safe mode. It finds beween 8 and 60 items. Mostly Malware and DataMiners. Then once I fix those I rescan and it comes up clean. However, I am still getting pop-ups, I have EnhanceMySearch, and when I log off and log back in... and re-run Ad-Aware I still have 8-60 items that show up and the same problem persists.

Can anyone help and point me in the right direction? It is a major annoyance. THANKS TO EVERYONE IN ADVANCE!!
 

Answer:It all just keeps coming back

Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
 

11 more replies
Relevance 49.2%

hi, i hope somebody can help me. I'm running windows 95 b with internet explorer 5.5 and I keep getting "Error loading C:\WINDOWS\TEMP\se.dll". when I run IE, avg detects trojan horse startpage 16.bd and my start page is now advertising called "about: blank" I've deleted se.dll but it just keeps coming back. I'd appreciate any suggestions. thanx!
 

Answer:se.dll keeps coming back!

it sounds like you got hijacked. this should have been posted on the spyware specific board. follow the instructions on this link below.

http://forums.majorgeeks.com/showthread.php?t=35407 <--
Sticky: READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

g/l - sos
 

1 more replies
Relevance 48.79%

Hi all I own a Gainward 6800GT and yesterday it started making funny 'tick tick tick sounds' somehitng u would hear from a geiger counter when theres radiation (well according to what i heard in games and movies anyway lol) and i was wondering if anyone knows whats wrong with it?

thank you

Answer:Strange sounds coming from graphics card

Does your VGA Card has a Fan it could be the fan hitting itself when it spins the heat can cause that. it happened to me once.

8 more replies
Relevance 48.79%

Hello everyone!Computer descriptionModel: VECTRA VL 420 MTPROD : P6200W#ABAOS: Windows XPThis computer stopped working, when plug the power cable the front panel light comes on without me hitting the power button.After that there is a short display on the screen as if it is starting then it disappears, the PC makes a very strange sound for sometime, when that strange sound is gone, and then it beeps two times.I tried changing power supply but the problem continues, I unplugged all devices except for the CPU and power supply, I turned it on the same noise persists, it starts with a very strange long noise, when that noise is over it beeps two times. I tried removing the BIOS Battery, still no success.Can someone please help?[attachment deleted by admin]

Answer:Hardware failure with strange sound coming from the PC

I forgot to mention, i have attached a Zipped MP3 file, please open it and listen to the strange sound, perhaps that can give a clue of whats i'm trying to say and Shaw as what is wrong. Any help is welcomed

14 more replies
Relevance 48.79%

When I click "play" on World of Warcraft, I get a error message that says

WoW.exe - Bad Image

The application or DLL C:\WINDOWS\system32\OPEN32.dll is not a valid Windows image. Please check this against your installation diskette.

I tryed to reinstall WoW, and that didnt help. I also ran several virus scans and those did not help.

I later found that when I click "system information" in "my computer", I get the same error message (it just dosint say WoW.exe of course).

I dont know if this is related or not, but another problem I have is that when I click User Accounts, I get a completly white screen with nothing on it, and nothing ever loads. If this is unrelated then I dont mind ignoreing it.

I run windows XP, and if there is any other specs i sould post then let me know.
 

Answer:strange error message coming up when I try to play WoW

Put in your XP CD, close the window if it autoloads. Then, Start > Run > sfc /scannow

to check for valid system files.
 

1 more replies
Relevance 48.79%

Hi.

I have a problem:
Yesterday when I was playing a game on my PC a strange sound started coming form my graphics card. I have never experienced this before.
I have an ATI Radeon HD 5870.

At first I thought it was one of the fans, so I removed the graphics card and cleaned the cooler and the fans as much as possible. I also cleaned the side fan of my chassi. The sound is still there.
I tried controlling the graphics cards fans manually and setting them to 100%. I could hear the fans speed up, but the annoying sound was gone.

Whenever I start a game, movie or other thing that makes my graphics card work the sound returns.
I filmed a video using my cell phone to illustrate the sound:

Strange sound - YouTube

Does anyone know what the sound is? Is it possible to fix it?
Can I be certain that the sound is coming from my graphics card?

Thanks in advance.

Answer:Strange sound coming from graphics card

other suspects could be the CPU cooler.

try using a finger (or a pen) to momentarily stop (a second or so, not much more) the graphic card fan, then cpu fan and then chassis fan when you hear this noise. if it stops when the fan is stopped, then you found the device responsible of the noise.

fans do similar annoying sounds when getting older.

1 more replies
Relevance 48.79%

                        I am trying to get my instructions checked but there are so many obsticles that appear.
                             Different ones from hour to hour..To be honest i felt like giving up as i suffer from
                            psoriasis and it's bad..Now my pc is cutting out like it's overloading, or overheating..
                             Can anyone tell me about this address..I have Google browser but cant be sure
                                                           if it's the real browser..I doubt it is,..
 
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36,gzip(gfe),gzip(gfe)"
 
                             I am on with the preperation for wiping all the nasties from my pc with your instructions            
 
                                      &... Read more

Answer:Strange Address coming when i check my IP from Gmail

Sorry to cause problems here..I am having problems backing up my files..I followed all the instructions...
 
This was what i got in the back up with my back up
 
2015-04-08 15:27 The log tab has been cleared. The log file with its full content is still available from the Log menu
    2015-04-08 15:27 *** A new backup has started. Number of tasks in queue: 1 ***
    2015-04-08 15:27 Preventing the system from entering sleep mode...
    2015-04-08 15:27 ** Backing up the task "New task" **
    2015-04-08 15:27 Counting the files for the task "New task"...
    2015-04-08 15:27 Starting the Volume Shadow Copy snapshot for the drives: C:\
ERR 2015-04-08 15:27 Couldn't contact the Volume Shadow Copy requester. Please check that the service is installed and running
    2015-04-08 15:27 Warning: The .NET 3.5 framework doesn't seem to be installed on your computer. This platform is needed to execute the Volume Shadow Copy requester 
    2015-04-08 15:27 Changing the backup type to full. Reason: task's first backup
    2015-04-08 15:27 Creating the destination directory "USB DISK\"
ERR 2015-04-08 15:27 Couldn't create the destination directory "USB DISK\": The filename, directory name, or volume label syntax is incorrect
    2015-04-08 15:27 Creating the destination directory "USB DISK\"
ERR 2015-04-08 15:27 Couldn't create the destination directory "USB DISK\": The filename, direct... Read more

2 more replies
Relevance 48.79%

So, today while I was playing World of Warcraft, my computer started making strange noises at me. At first I thought I had left an internet tab open or something because I kept hearing commercials and pop news highlights coming through my speakers. But after making sure that everything was shut off, the noises kept coming. Upon further inspection through my volume mixer I found this strange program producing noise but it had a "No Name Available" as a descriptor.

I have run Malwarebytes Pro and Combo and uninstalled everything that I had run today but it still persists. I even did a full system restore dating back a couple weeks yet the noises keep coming. PLEASE HELP! I have no idea what's causing this and it is literally driving me batty. Any ideas?

Desperate for answers,

ArcadianPhoenix

Answer:Strange sounds Coming from Mysterious program

So, today while I was playing World of Warcraft, my computer started making strange noises at me. At first I thought I had left an internet tab open or something because I kept hearing commercials and pop news highlights coming through my speakers. But after making sure that everything was shut off, the noises kept coming. Upon further inspection through my volume mixer I found this strange program producing noise but it had a "No Name Available" as a descriptor.I have run Malwarebytes Pro and Combo and uninstalled everything that I had run today but it still persists. I even did a full system restore dating back a couple weeks yet the noises keep coming. PLEASE HELP! I have no idea what's causing this and it is literally driving me batty. Any ideas?Desperate for answers,ArcadianPhoenix'Strange sound' is not very indicative of the type of sound you're hearing. Could you be a little more precise? Is it for example, a buzzing noise, a high pitched whine or what?

8 more replies
Relevance 48.79%

So, sometimes when my Win 8.1 machine comes out of sleep mode, it seems to lose focus. What I mean by that is some items in the notification area disappear and that item no longer works.

Example: Windows just came out of sleep mode and now my Outlook icon has disappeared in the notification area and Outlook is no longer functioning. Same happens with other items in the notification area like Catalyst Control Panel, SoundBlaster soundcard control panel, and a few other items. They just disappear from the notification area and cease to function. The only way to get them back and functioning again is to restart the PC.

This only happens when the PC comes out of sleep mode, though it is random.

Any ideas?

BTW you can view my system specs for questions concerning it.

Thanks.

More replies
Relevance 48.79%

Hello

I have strange clicking or cracking sound intermittently. It look like a static interference noise (but it is not a static interference) This is worst when I'm listening to a video on Youtube.
Clicking or static could be hear, even when the video as stopped. Look like the system can't keep up

I played with the sound mixer. I got many applications running at the same time that sent me sound indicators

The clicking sound is lowered when I lowered the sound on the : "Sound System", leaving the others on the max level. When clicking or static do occurs, I could clearly see on the System Sound level bar, the increase or the movement that occured in the "System Sound" application

This is clearly an electronic or drivers problem, not a speaker or physical one

Hope I'm clear enough on my approximative English

Any help appreciated

Answer:Strange clicking noise coming out of speaker

Hi.
Cracking sounds you described could be generated by signal interference, oscillating electronic circuit, or even any loose end of connectors/plugs.
Since you're sure it isn't about your sound system, I try to help you making some guess.
Make sure there is no inducting device too near to your machine (fan, motorized device)
Observe your sound input cable and both side connectors/plug, are they all intact, and well fitted.
If you plugged it in on front audio panel, unplug it, and try to plug it in on rear audio panel
No more guess can be made here, but hope it could give you something.

Kevin

6 more replies
Relevance 48.79%

I have my Toshiba laptop A200-23 model PSAE6E for 1.5 years and I recently got it back from service.
I've sent it there because of a non functional key.

Everything is fine, they've changed the keyboard... but ever since I've got it back I have noticed some strange noise coming from to fan area...

The sound is not so loud but it's quite annoying.
I have cleaned it using compressed air, but the sound did not dissapear.
It is still under warranty but I don't think that they would do something against this noise.

The laptop is working fine, it isn't overheating or something but I can't get used to this sound.
Whatd should I do?

Answer:SatelliteA200-23k - strange noise coming from to fan area

Hi

Difficult to say what noise could it be?
But if the notebook was disassembled by an ASP technician in the past, then you should get in contact with the same technicians again and should explain your situation!
Maybe a screw has been forgotten? who knows?
I think the technician should take a look on this notebook again?

I would not recommend opening and disassembling the notebook yourself because you could cancel the warranty?

2 more replies
Relevance 48.79%

I've noticed quite a few peopel are having trouble with this, so I wetn through another post and did everything recommended in tat post but I am still not having any luck.I did what was offered in this post:http://www.bleepingcomputer.com/forums/ind...4&hl=googleI have now ran super antispyware, avast antivirus, ran atfcleaner, otscanit, GMer, ComboFix, and HijackThis ... and i still have the same issues.I have attached the HIjack this log, as well as the otscanit, GMer, and comboFix

Answer:Google search coming up with strange links

gmer file

5 more replies
Relevance 48.79%

Hello. I am using a Dell Latitude 1150. It has an ESS Maestro PCI soundcard. Whenever I use the laptop, there is a strange electric/electronic noise... it intensifies when I move hte cursor, and when the comptuer is loading. It is not white noise. It is not a ground loop. It is very strange. When I hooked an RCA cable from the "Tape Out" of my mackie mixer, into the input of the laptop; the recording was ruined, because of this noise. I will try and post an audio sample of this noise eventually. But... it is definitely digital. It is somewhat pitched; and reminds me of the sound cheap portable CD players make through headphones when switching between tracks.

Anyways, my question is, is this hardware or software related? ESS has not released any driver updates for WinXP besides what was on the WinXP installation CD. I have 5 other identical laptops, and they all have this problem.

Any help much appreciated,

AlexTs
 

Answer:Strange electrical noise coming from soundcard

8 more replies
Relevance 48.79%

http://files.bighosting.net/yq4496.mp3

That is a 32 second mp3 (328kb - sorta faint, turn volume up) of a noise I have been hearing on my radios, phone & computer for over a year now. Different radios, different phones, different computers... and different locations! I first started hearing it at my house, before the divorce. Not all the time, it was an occasion thing. Thought I was losing it.

But then my son heard it, and my ex-wife. I could never get a recording of it because it was completely random; you never knew when it would happen. You might hear it three times in a day, then not hear it again for weeks.

I hadn't heard it since I moved into this apartment four months ago (so I figured it was related to the house itself, a wiring thing or something, I dunno), until today... and today it has been going non-stop! WTF is it?? It's makin' me nuts. I think I'll send it in to Art Bell
 

Answer:Strange noise coming through computer speakers

Link's broke... try this one
http://home.comcast.net/~fahfooh/noise.mp3
 

4 more replies
Relevance 48.79%

So for the past couple of weeks my computer has been having some issues with these red lines coming across the screen I've attempted everything (except change the graphics card and hard drive) I have asked a few people who know computers and they never saw this sort of thing. It comes up with red lines then restarts but now with the red lines all over the screen. I'm running a GeForce 760 some one please help

Answer:Strange Red Lines coming across computer screen

This is what I'm seeing from my computer
click here

3 more replies
Relevance 48.79%

So ive had this this ticking problem before with my old HDD so thats the reason i bought a new one and the problem is still there. When that happens (only when playing games) the game freezes for about 10-20 seconds and just continues but sometimes i also get BSOD with error: MEMORY_MANAGEMENT. Ive been trying to find a solution to this but still no avail. Checked the HDD and its health is at 100%, ran multiple memtests and no errors found. Please someone help.
 

Answer:Strange ticking/clicking noise coming from HDD

How do you know the sound is coming from your HDD? If you purchased a new one with the same problem then it's likely something else in your system that's the culprit. Since you're receiving a MEMORY_MANAGEMENT error it probably has something to do with your RAM, so I suggest replacing it and seeing if anything changes.

It also wouldn't hurt to post system specifications, specifically your HDD and RAM information.
 

2 more replies
Relevance 48.79%

Every once and a while I here a strange series of clicking sounds coming from my pc tower. I built this pc and can’t think of what it could be. It sounds like someone’s turning on and off a light switch over and over. There are no symptoms in the software environment. Some times a series and sometimes a single “click” like someone turning on a light switch once. What do think it could be?
 

Answer:strange clicking sound (coming from tower)

Might be the click of death - hard drive failure. You're going to need to take the side off the case and wait for it to happen again. I guess it could also be a bad fan or something brushing against a fan as well - lets hope. While you wait you should back up the contents of the hard drive or at least the important things so if it dies you aren't completley unprepared.

Oh, and you can also download the hard drive manufacturer's diagnostics and test the drive - if the drive is click or periodically it may not fail the tests but its worth a shot.
 

1 more replies
Relevance 48.79%

Hi there, I've recently built a new comp for audio work and everything is finally working except my now I can hear a strange garbled audio noise through my speakers once booted into windows. There is a constant ticking or whirring noise and when I move the mouse a I get a sound similar to a dial up modem noise. Halfway between a screech and a scrape.

Things I have tried:
Isolating the mobo and all the components from the case placing the mobo on an anti static bag and then a card box.

Updating Bios, soundcard drivers and graphics card drivers.

I've also tried using the onboard sound and this produces the same results.

I've also tested the soundcard, video card, PSU, and HDD in my old computer and booting from the same HDD produces no unwanted noises what so ever, the only things I can't test are the CPU, RAM and obviously the mobo itself.
I'm going a bit insane over this after about 8 phone calls to the retailer and numerous emails to gigabayte who don't seem to understand the problem.

I have no way of testing the CPU but I can't see it being the cause of the problem

Anyone's thoughts on this would be more than welcome. I even considered asking PC world (the only computer shop near me) for help, that's how desperate I'm getting.

Here's the spec:

Gigabyte EX58-UD5 Mobo
Intel i7 920
Noctua CPU cooler
12 OCZ Ram 1600MHz
ATI Radeon 4670 Graphics card (passive)
EMU 1820 Soundcard + Breakout Box
Be Quiet Dark Power P... Read more

Answer:Strange noises coming through speakers on new build

Suggest you begin unplugging cables and power sockets to see if you can make it stop... that may be a strange way of trouble shooting... But you may have audio feedback from a defective device... and first you have to find the device.
I assume you have carefully checked each and every cable and connection... an assured that everything is fully plugged in...
I would suspect the Sony optical drive, as we have seen noise emissions linked to that unit.

Try to get down to power supply, hard drive, one memory module, audio socket, and speakers... And also test the speakers on a friend's computer.
There are a great number of devices that, when defective, will cause this... so a systemized approach, with notes, may be helpful.
This happens to broadcast engineers all the time... and it is usually a mistake they have made with one cable or connection or another.
 

10 more replies
Relevance 48.79%

Evidence:

Spoiler


 
Oh and hello, I am new to this forum.
 
 
Here is my issue:
 
There is this strange sound playing randomly. I have no idea what it is and I have done everything to try to get rid of it.
 
I tried:
*Checking system sounds
*Malware bytes
*TDSSKiller (to be sure it's not a rootkit)
*A bunch of different varieties.
 
 
Can someone tell me what this sound is and if possible, tell me how to fix it or what it is coming from?

Answer:I have little to no idea what this strange sound is coming from + Evidence

Please download TDSSKiller from here and save it to your DesktopDoubleclick on TDSSKiller.exe to run the application, then click on Change parameters


Check Loaded Modules  and Detect TDLFS file system.  Do not check Verify file digital signatures (even though it is checked in the example)If you are asked to reboot because an "Extended Monitoring Driver is required" please click Reboot now


Click Start Scan and allow the scan process to run

If threats are detected select Skip for all of them unless I instruct you otherwiseClick Continue


Click Reboot computerPlease post the contents of  TDSSKiller.[Version]_[Date]_[Time]_log.txt found in your root directory (typically c:\)in your reply===================================================aswMBR--------------------Download aswMBR and save it to your desktop.
Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily. They will interfere and may cause unexpected results.If you need help to disable your protection programs see here and here.Double click the aswMBR.exe file to run it. Please allow when you are asked to download AVAST antivirus engine defs.Wait until the AV update is done, then click on the Scan button to start. The program will launch a scan.

When done, you will see Scan finished successfully. Please click on Save log and save the file to your desktop.

Please post the contents of the log in your next reply.NOTE:  aswMBR will create M... Read more

21 more replies
Relevance 48.79%

Hi.

My brother has a Toshiba Satellite Pro A60 - my old laptop. However it has a strange sound issue. I wiped it a few months back, and the sound worked fine. However after a week or so it suddenly started sounding like the speakers were blown.

I made the assumption that the speakers were indeed blown and plugged in external speakers - however they made the same noise! I was wondering, does this sound like a fried sound card, or a drivers/software error?

If it is a sound card error, can the sound card be changed?

Answer:Satellite Pro A60: strange sound coming from speakers

Hi,

no the sound card couldn?t be changed, it?s on the mainboard and if you want to exchange it, you must exchange the whole mainboard.

First question: do you have still warranty on that machine?

Then my suggestion:

Backup all data on the machine, recover it with the recovery CD and then the noise should be gone. If not, and if you got still warranty on that machine, then it would be better to bring the machine to an service partner for an hardware checkup.

Give some feedback if you got some further questions.

Greets

1 more replies
Relevance 48.79%

Hi Since this evening a weird sounds has been coming out of the right speaker/earphone of my laptop. It is a weird beeping/cherping sound which will make which makes about 5 short bursts in less than a second, then about 4 seconds before doing it again. There is also a strage creeking/glitchy sound which seems to be louder, more noticeable when the computer is working. When idle is sounds kind of like a heard beat with a random elecrical creak
I know the description is strange but this this the only way i can describe it.

There is no other electrical equipment around me which could be causing intefeance. Also I tried moving around the house it was the same everywhere.
And again, it only comes though the right speaker (earphone if i have them plugged in!)

I have also tried resarting my computer and trying a differnet user account.

My computer is a Acer Aspire 5670 (laptop) About 3 and a half years old. Running Windows XP Service pack 2

Thanks for anyhelp =]
 

Answer:Strange sound coming from right speaker/earphone

Hi everyone I played around with RealTek HD audio manager on my laptop and managed to get rid of the weird sound and make my laptop output sound lounder. The settings must of been set wrong or somehow changed accidently
 

2 more replies
Relevance 48.79%

I recently own a Tecra 9000, it was running swell until it started to give off ticking sounds. I am 100% sure that it isn't coming from the speakers. The sound appears to be coming somewhere around the hardrive it self and after the ticking sound the system goes to a blue screen like the one you see when it crashes.

Answer:Strange sound coming from Tecra 9000

Please some more informations. Did you check the function of CPU fan, does it work? (blowing noise)Did you take off the HDD and run it from a bootable disc/CD only?

3 more replies
Relevance 48.79%

I accidentally installed trovi and after spending hours trying to remove it I think its mostly gone, hoever every time I run a scan it still shows up as a threat even though I can no longer see it in my browser. I've followed the guide and have no idea where to go from here so and help would be greatly appreciated.
 

Answer:Trovi Keeps Coming Back!

Hello,
Before we start please note the following:

Analysis and research take some time, also sometimes real life gets in the way, please be patient.
Limit your internet access to posting here, some infections just wait to steal typed-in passwords.
Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.
Do not paste the logs in your posts, attachments make my work easier. There is a Upload a File button which you can use to attach your reports. Attach all reports.
Stay with me to the end, the absence of symptoms doesn't mean that your machine is fully operational.
Note that we may live in totally different time zones, what may cause some delays between answers.

I can't foresee everything, so if anything unexpected happens, please stop and inform me!
There are no silly questions. Never be afraid to ask if in doubt!
Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.
Running it on another one may cause damage and render the system unstable. ​
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!
Right-click on icon and select Run as Administrator to start the tool.
(XP users click run after receipt of Windows Security Warning - Open File).
Press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you l... Read more

16 more replies
Relevance 48.79%

I'm not entirely sure what infection I have here, but I think it has something to do with the Coupon Printer my friend downloaded a while back (I'm cleaning her computer for her)It started out with a bunch of fake AV programs screaming at me to "fix all the infections". I downloaded and installed MBAM, but I couldn't run it until I rebooted in safe mode. It found 8 or 9 items and I cleaned them all. One of them was the following:C:\Users\Haley\AppData\Local\Temp\Low\COUPON~1.DLLEvery time I restart the computer and re-run MBAM, that same file shows up, no matter how many times I've tried to delete it.I thought I had fixed all the nasties because the fake AV is now gone, but I'm not so sure anymore. I'm pretty good at malware removal, but not great, so I thought I'd ask you guys to take a look.Thanks!!DDS (Ver_10-03-17.01) - NTFSx86 Run by Haley at 0:15:15.58 on Tue 05/11/2010Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13Microsoft? Windows Vista? Home Premium 6.0.6001.1.1252.1.1033.18.3034.1804 [GMT -6:00]SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}============== Running Processes ===============C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k rpcssc:\Program Files\Microsoft Security Ess... Read more

Answer:Malware that keeps coming back

Hi,Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.Please subscribe to this topic, if you haven't already. You can subscribe by clicking the Options box to the right of your topic title and selecting Track This Topic.Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.Please reply to this post so I know you are there.The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.Once I receive a reply then I will return with your first instructions.Thanks

12 more replies
Relevance 48.79%

Hey, so i've gotten this malware and i know what program caused it but i deleted it and have no clue now, sorry :/ But the main issue is, as i said i cleaned it with Adwcleaner and it finds it and removes it (I'm certain that's it but when i restart chrome it "re-installs" itself. Also I've used FRST but i don't know how useful it will be as i'm puzzled whether it worked or not Now enough from the cryptic talk.

it's under
C:\Users\my user\Appdata\local\google\chrome\user data\default\secure preferences
inside the file (opened with notepad++)
this is the culprit:
plnkhmnoajbfccclonaeepohggeolcih (more details in uploaded logs)
Also, over time due to the popups it also installs some random tinytask thing + uk.ask.com or whatever search provider (also in logs)
Now, as i mentioned above i've checked installed programs and services and found nothing out of the place. I have no clue how the hell should i go about fixing this as its a nasty malware that doesnt wanna get removed. The only sites i found relating to this issue are spanish and the forums even with translate didnt help much so i'm here to ask for some help! Thanks for anything in advance
 

Answer:Malware keeps coming back

Hello,

Your FRST report is empty and you are missing Addition.txt report.
 

9 more replies
Relevance 48.79%

Hi, So I have this virus. Everytime the windows start, and if its connected to the internet before anti malware malwarebytes protection on, It will start downloading virus like crazy. MBAM can limit the virus somehow, but it still somehow allowed wuaucldt.exe and VRT***.tmp (*** is random number) and sometimes some random dll files. I also got random number dot exe and it contain w.exe, d.bin, ms.bin, so.bin. All of this happened if i connect to the internet and worse if there is no MBAM protection. I tried to remove it through registry and hijackthis, it just keep coming back. Make me think that all my exe files has been infected.I sent winlogon.exe to several online file scanner and apparently has Virut on it.I tried to use DDS.scr, but i keep getting error (0xc0000142). I tried to rename it lots of time with any name that i can think of and still the same problem. I tried to rename the file name into bat or exe, same problem.ComboFix also has the same (0xc0000142) error. Gmer works, but it keeps going to the blue screen everytime I scanned a lil longer (say more than 2 minutes). So I uncheck registry and files to make it faster. Here's the log.I also attached hijackthis log if needed. Oh, I use Windows 7, and updated MBAM.Thank you so much. Sorry for my English. I really really appreciate it.PS : Sorry for repost. I don't know why the logs is not appear in the previous post.Just in case if the log dissapear again, i copy it to here :GMER 1.0.15.15281 - http://www.... Read more

Answer:wuaucldt.exe keeps coming back

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

10 more replies
Relevance 48.79%

Logfile of HijackThis v1.98.2
Scan saved at 1:23:38 PM, on 12/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe
C:\Program Files\Messen... Read more

Answer:It keeps coming back!what am i doing wrong

Let's use a program to scan for any trojans that may exist. Download TDS-3. Learn how to use it here. Make sure to update it after you installed it. You can get the manual updates here. When you launch the program, it will scan your memory for running processes. This will take less than 30 seconds. Next go to System Testing on the menu and choose Full System Scan. After that's finished, post the log file by selecting everything on the top pane (select from bottom to top).

3 more replies
Relevance 48.79%

Hi. My problem seems similar to what others have posted, but I know that each system is unique.It seems like I am infected with some sort of malware. I was phished, but my norton symantec caught the trojan. However, now every two or three days the trojan comes back, only there are more and more of the infection. I tried a number of malware removal progams, which frequently find a problem. However, it has not solved the fact the trojan returns again in greater number in two or three days.Thanks.Below is my DDS file:DDS (Ver_2012-10-19.01) - NTFS_AMD64 Internet Explorer: 9.0.8112.16421Run by XXXXXXX at 15:56:52 on 2012-10-31Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.9207.6118 [GMT -4:00].AV: Symantec Endpoint Protection *Enabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}SP: COMODO Defense+ *Enabled/Updated* {FEEA52D5-051E-08DD-07EF-2F009097607D}SP: Symantec Endpoint Protection *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}FW: Symantec Endpoint Protection *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}FW: COMODO Firewall *Enabled* {7DB03214-694B-060B-1600-BD4715C36DBB}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Program Files (x86)\Common Files\Comodo\launcher_service.exeC:\Windows\... Read more

Answer:Trojan keeps coming back

Interestingly, I just ran rkill.exe and the problem returned. So, a number of "tmp" files were created in my users/MYNAME/AppData/Local/Temp folder.

The rkill log was:
Rkill 2.4.3 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 10/31/2012 09:50:47 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* Explorer Policy Removed: NoActiveDesktopChanges [HKLM]

Backup Registry file created at:
C:\Users\XXXXXXX\Desktop\rkill\rkill-10-31-2012-09-51-01.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware" = dword:00000001

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.
Startup Type set to: Manual

* gpsvc =&g... Read more

34 more replies
Relevance 48.79%

I have already been through the "Am I Infected" forum and I am sure that I am but I don't know how or with what. Topic referenced is here: http://www.bleepingcomputer.com/forums/t/305217/security-breach/ ~ OB We have run MBAM and GMER and removed some infections and the next day when I ran my Spyware Doctor, I was reinfected with two new infections. Already identified them as keyloggers and one was some type of autodialer. Anyway, I was told to run a DDS and post it here. Time for an operation, I guess. LOL I am hoping to learn something from the process. I have already learned a lot just reading and researching on my own before I broke down and came to bleepingcomputer for help. I know when something is over my head and whatever this is.....is it! Thank you so kindly for the help! Here is the DDS. I did run a GMER last night but for some reason, my system had crashed when I returned the computer so I did not have the results. If you would like for me to run another one, please advise and I will do it ASAP. DDS (Ver_10-03-17.01) - NTFSx86 Run by Compaq_Owner at 0:48:56.29 on Sun 04/04/2010Internet Explorer: 7.0.5730.11Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.191 [GMT -4:00]AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchC:\WINDOWS\system32\svchost -k rpcssC:\WINDOWS\System32\svchost.ex... Read more

Answer:Malware keeps coming back.

Hello and and Welcome to BleepingcomputerPlease note we are very busy, so if I don't hear from you within 5 days the topic will be closed, If you have sinceresolved your issues I would appreciate if you would let me no so I can close this topic.We need to create an OTL ReportPlease download OTL from one of the following mirrors:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.Under the Custom Scans/Fixes box at the bottom, paste in the following bold text.%SYSTEMDRIVE%\*.exe/md5starteventlog.dllscecli.dllnetlogon.dllcngaudit.dllsceclt.dllntelogon.dlllogevent.dlliaStor.sysnvstor.sysatapi.sysIdeChnDr.sysviasraid.sysAGP440.sysvaxscsi.sysnvatabus.sysviamraid.sysnvata.sysnvgts.sysiastorv.sysViPrt.sys/md5stopCREATERESTOREPOINTPush the button.Two reports will open, copy and paste them in a reply here:OTL.txt <-- Will be openedExtra.txt <-- Will be minimizedThanks

42 more replies
Relevance 48.79%

i scanned my flash drive with Avast antivirus and it detected a virus "antisys.exe". i had it removed but after using the disk and running a scan again, its back. I don't see the file on the drive but Avast kept telling me it is infected with the "antisys.exe" virus. and after deleting the file using avast and running a scan again, it's still there. Is it really a virus? how do i remove it without losing all the data in my flash drive. Any help is greatly appreciated. Thanks in advance.
 

More replies
Relevance 48.79%

Hi!

I keep getting something called "Websiteviewer" constantly coming up. I've tried Ad-aware and Spybot in safe mode with no results.

Here is my HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 8:10:57 PM, on 2/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\brsvc01a.exe
C:\WINDOWS\System32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\shch.exe
C:\WINDOWS\clfmon.exe
C:\Program Files\Toshiba Controls\CpRmtKey.EXE
C:\Program Files\EzButton\CplBTQ00.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\i... Read more

Answer:Websiteviewer keeps coming back!

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer. After we are finished with your log file and verified that it's clean, you may turn it back on and create a new restore point.

The Temp folders should be cleaned out periodically as inst... Read more

3 more replies
Relevance 48.79%

I have not had such an issue removing malware until this one. I say Superfish since it comes up with MalWareBytes every scan. IT is located in C:\Users\*\AppData\Local\Google\Chrome\Default\Local Storage\. Everytime Chrome opens.
 
 
I can remove the PUP, restart and be good to go until a few minutes running chrome. IE is not affected. It will not replicate. I have used Rkill to stop processes and followed with MBAM. I have used AdWCleaner and JunkWare Removal Tool. I have run a sleugh of others as well.
 
I have cleaned up the Programs list with what I feel are neccessary. No unwanted as far as I can tell. I have done my due diligence with this.
 
I have also removed Flash, Reader, and Java and have updated with latest versions from valid sites. I have disabled PepperFlash in Chrome and tried a default Flash but came back as well.
 
I have traced the infection to the registry (made a back-up first, but am pretty comfortable around it as well) and removed the points of infection there. It works great with IE but a few seconds after Chrome is opened, it's back. I have use Chameleon as well, thinking the browser themselves could be infected.
 
I believe it is a file dropper located on the computer. I thought I was successful with a program located in the TEMP directory associated with Mozilla but no luck.
 
SAS only picks up Tracking Cookies.
MBAM will pick up Superfish Located in same Directory stated earlier but no Tracking Cookies
Rkill sto... Read more

Answer:SuperFish Keeps Coming back

Have you tried resetting the hosts file?
Also, try examining the shortcuts to Google Chrome. Sometimes a hyperlink is in the Target: 

24 more replies
Relevance 48.79%

I ran CCleaner, then superantispyware, then Malwarebytes and removed the Trojan, I then ran Hitmanpro and removed all it came up with. I then run MB again and the same 4 Trojans keep coming up. Here is the log of MB

Malwarebytes Anti-Malware (PRO) 1.65.1.1000
www.malwarebytes.org

Database version: v2012.11.06.12

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
edteach :: EDTEACH-PC [administrator]

Protection: Enabled

11/7/2012 8:41:33 AM
mbam-log-2012-11-07 (08-41-33).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 234675
Time elapsed: 7 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 4
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DhcpNameServer (Trojan.DNSChanger) -> Bad: (213.109.67.72) Good: () -> Quarantined and repaired successfully.
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters|DhcpNameServer (Trojan.DNSChanger) -> Bad: (213.109.77.23) Good: () -> Quarantined and repaired successfully.
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{77D50DC3-0F48-4B2D-99E0-19CCE6892D99}|DhcpNameServer (Trojan.DNSChan... Read more

Answer:TrojanDNSCHARGER keeps coming back

Please follow these instructions:

READ & RUN ME FIRST. Malware Removal Guide
 

1 more replies
Relevance 48.79%

HJT for Check up
Ran adaware, ms antispyware beta, can't get to housecall or install wincritical updates.
I have a cd with sp2 which I will try to update.

Logfile of HijackThis v1.99.1
Scan saved at 12:11:35 AM, on 9/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:... Read more

Answer:Web Hijacker keeps coming back

Hi ucurl

Has this system been rebooted since you posted this Hijack log?

If so, please post a new log.
 

1 more replies
Relevance 48.79%

Hi, I have (thanks to this forum) downloaded spybot and run a check, which removed unwanted files. however, after visiting the internet I thought I would check again and the following file appears every time I even start up IE. 'DSO Exploit'DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-21-807862539-876780862-1957817608-1012\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3DSO Exploit: Data source object exploit (Registry change, nothing done) HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3--- Spybot - Search && Destroy version: 1.3 ---2004-07-09 Includes\Cookies.sbi2004-07-28 Includes\Dialer.sbi2004-07-27 Includes\Hijackers.sbi2004-07-27 Includes\Keyloggers.sbi2004-05-12 Includes\LSP.sbi2004-07-27 Includes\Malware.sbi2004-07-09 Includes\Revision.sbi2004-07-02 Includes\Security.sbi2004-07-27 Includes\Spybots.sbi2004-07-28 Includes\Tracks.uti2004-07-27 Includes\... Read more

Answer:spyware keeps coming back

dso exploit is nothing to worry about.Run a check with this click here

10 more replies
Relevance 48.79%

So my computer got a virus from a game that I tried downloading. Avast! did a boot scan and got rid of it, but a day or two later, I got messages from Chrome that said I had a virus again, but of course those are usually scams. I did another scan, just to be safe, and Avast! found two items, got rid of them, and ran another boot scan, just to be safe.

Next day, I figured it had to be from Chrome because of the fact that I attempted to download the game from Chrome and was getting odd popups and such but IE wasn't doing that. So I deleted it. My friend suggested downloading Malwarebytes so I did that as well. It found two more Trojans and so did Avast! after a full system scan. Got rid of those as well and found they were gone afterwards.

I can't tell if my computer is infected again but earlier Malwarebytes apparently blocked a couple malicious websites, and since Avast! usually did that when the virus would come back, I ran another scan and found one thing, a YouTubeAdBlocker, I don't know if I wanted to get rid of that because an AdBlocker sounds like something I would want to keep and I heard that sometimes, Malwarebytes finds things that aren't really dangerous, but idk I am not an expert. I tried not to worry about it after that but I just want to be safe.

I am running two full system scans as we speak with Malwarebytes and Avast! to see if they will find anything that way since quick scans didn't find anything (except the AdBlocker again) and... Read more

Answer:Virus that keeps coming back?

Hi,
In order to help you, we need reports generated on your system. Please follow this topic and attach requested reports: http://malwaretips.com/threads/malware-removal-assistance-how-to-get-help.20334/
 

1 more replies
Relevance 48.79%

Hi - I recently got infected with a virus that added options to my toolbar (Fresh Search) which I managed to fix thanks to the help I saw posted here, but I still keep getting pop-ups and infections - SearchToolbar, Spyware.Msnagent and DownLoader.Trojan being the most recent. None of the anti-spyware, pop-up blockers or anti virus programs I have can stop the reinfections.

I have gone into safe made, used CWShredder, CClean, Kill2Me, HSRemove and Stinger. Also RAVAntivirus online scan, Bitdefender online scan, AdAware SEplus and Norton Antivrus. I used Silent Runners and found some suspect entries, which I edited out of the registry using Registrar Lite, and I used Hijack This to find and fix some other suspicious entries.

But they all keep coming back, in one form or another. Not crippling like before, but really annoying!

Below is a recent Silent Runners report, followed by a HiJack This report:


"Silent Runners.vbs", revision 40.1, http://www.silentrunners.org/
Operating System: Windows 2000
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"internat.exe" = "internat.exe" [MS]
"NvMediaCenter" = "RUNDLL32.EXE D:\WINNT\System32\NVMCTRAY.DLL,NvTaskbarInit" [MS]
"NBJ" = ""D:\Program Files\Ahead\Nero BackItUp\NBJ.exe"" ["Ahead So... Read more

Answer:Virus Keeps Coming Back

16 more replies
Relevance 48.79%

i recently have been getting more popups, and they have been saying "brought to you by 180 search assistant" i have ran numerous different types of spyware scan and they have deleted spyware but it keeps coming back. Also i have been getting trojan horses that keep coming back also.
im on xp home edition
thanx
 

Answer:spyware keeps coming back!! :(

8 more replies