Computer Support Forum

Strange pop up keep coming back

Question: Strange pop up keep coming back

Hi,
Everytime when i restart my computer i will get some strange wording pop up. Run ad-aware and have around 44 error. Remove them using ad-aware but when i restart computer and scan again the same error come back. Hope you all can help thanks.

Below are the log of each individual scan:

Panda active scan


Incident Status Location

Virus:Trj/Lineage.GCC Disinfected Operating system
Virus:Trj/Legmir.ATJ Disinfected Operating system
Virus:Trj/Wow.RA Disinfected Operating system
Virus:Trj/Lineage.FWB Disinfected Operating system
Virus:trj/spabot.e Disinfected Operating system
Adware:adware/baidubar Not disinfected Windows Registry
Virus:W32/Winko.P.worm Disinfected C:\auto.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Administrator\Desktop\Cleanup\SDFix.exe[SDFix\apps\Process.exe]
Potentially unwanted tool:Application/SuperFast Not disinfected C:\Documents and Settings\Administrator\Desktop\Cleanup\SmitfraudFix\restart.exe
Virus:Trj/Lineage.gen Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\LYLOADER.EXE
Virus:Trj/Lineage.GCH Disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\SHQMANGR.DLL
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8RAKC4NO\jh0619[1].exe
Possible Virus. Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\8RAKC4NO\qj0617[1].exe
Virus:Generic Malware Disinfected C:\HJT\backups\backup-20060902-103504-702.dll
Adware:Adware/Borlander Not disinfected C:\Program Files\symp\flzc.dll
Virus:Trj/Lineage.FRU Disinfected C:\Program Files\WZCN\cn_ie_wzcn.dll
Virus:Trj/Wow.RA Disinfected C:\WINDOWS\123
Virus:Trj/Wow.RA Disinfected C:\WINDOWS\49400MM.DLL
Virus:Trj/Legmir.ATJ Disinfected C:\WINDOWS\49400WL.DLL
Virus:Trj/Legmir.ATJ Disinfected C:\WINDOWS\555888
Virus:Trj/Wow.RA Disinfected C:\WINDOWS\888
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\bxsnlx.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\dwddhv.exe
Possible Virus. Not disinfected C:\WINDOWS\ekyfgc.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\futgfh.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\fxftil.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\fymixb.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\gfzkwi.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\htotyh.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\iczwaz.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\idlcnp.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\ipvyyv.exe
Virus:Trj/Legmir.ATJ Disinfected C:\WINDOWS\llllllab
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\lubzlz.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\phtwfu.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\plmoto.exe
Virus:Trj/Lineage.GAM Disinfected C:\WINDOWS\ptwjiy.exe
Virus:Trj/Lineage.GCD Disinfected C:\WINDOWS\qrxhrw.exe
Adware:Adware/BaiduBar Not disinfected C:\WINDOWS\system32\612fd7We.dll
Virus:Trj/BHO.O Disinfected C:\WINDOWS\system32\6b38Kx7T.dll
Virus:Trj/Qhost.gen Disinfected C:\WINDOWS\system32\drivers\etc\hosts.20061114-021815.backup
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\drivers\vdjkbf58.sys
Virus:W32/ZLFake.A.drp Disinfected C:\WINDOWS\system32\dtJ46pqB.exe
Virus:Bck/Hupigon.KGB Disinfected C:\WINDOWS\system32\F87D2198(2).DLL
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\system32\isqotp.dll
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\system32\k11937460752.exe
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\system32\k11937476962.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\k11938414462.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\k11939072683.exe
Possible Virus. Not disinfected C:\WINDOWS\system32\k11939163133.exe
Virus:Trj/Lineage.FWB Disinfected C:\WINDOWS\system32\k11939163155.exe
Adware:Adware/BaiduBar Not disinfected C:\WINDOWS\system32\KKIgQhmd.dll
Virus:Generic Trojan Disinfected C:\WINDOWS\system32\mcert.dll
Adware:Adware/VideoActiveXObject Not disinfected C:\WINDOWS\system32\mediaobjsetup.123.exe
Virus:Trj/Harnig.EQ Disinfected C:\WINDOWS\system32\n1178390509k.exe
Virus:Bck/Hupigon.KGB Disinfected C:\WINDOWS\system32\n1178921164k.exe
Adware:Adware/BHO Not disinfected C:\WINDOWS\system32\paoOFVhn.dll
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\scrsys16_070418.scr
Virus:Trj/Lineage.GCH Disinfected C:\WINDOWS\system32\SHQMANGR.DLL
Adware:Adware/NewWeb Not disinfected C:\WINDOWS\system32\vdjkbf58.dll
Virus:W32/Spamta.QO.worm Disinfected C:\WINDOWS\system32\vvrtshgi.dll
Virus:Trj/Patchlog.A Disinfected C:\WINDOWS\system32\winlogon(2)(2).exe
Virus:Trj/LastGood.B Disinfected C:\WINDOWS\system32\winlogon.exe
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\winsys16_070418.dll
Virus:Generic Trojan Disinfected C:\WINDOWS\system32\wsock32k.dll
Adware:Adware/BHO Not disinfected C:\WINDOWS\system32\Y5pyg500.dll
Virus:Generic Trojan Disinfected C:\WINDOWS\temp\4GPiPevG.exe
Virus:Trj/Lineage.GCH Disinfected C:\WINDOWS\temp\SHQMANGR.DLL
Virus:W32/QQPass.ATE.worm Disinfected C:\WINDOWS\xwfeyx.exe
Adware:Adware/Borlander Not disinfected C:\~deB.tmp
Adware:Adware/Borlander Not disinfected C:\~deD.tmp
DSS scan

Deckard's System Scanner v20071014.68
Run by Administrator on 2007-11-02 21:01:22
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
64: 2007-11-02 13:01:26 UTC - RP208 - Deckard's System Scanner Restore Point
63: 2007-11-02 12:44:38 UTC - RP207 - System Checkpoint
62: 2007-11-01 09:23:37 UTC - RP206 - Restore Operation
61: 2007-10-30 16:16:13 UTC - RP205 - System Checkpoint
60: 2007-10-29 00:35:56 UTC - RP204 - Restore Operation


-- First Restore Point --
1: 2007-08-04 05:56:31 UTC - RP145 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as Administrator.exe) ---------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 9:02:12 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\SnoopFreeSvc.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\program files\internet explorer\iexplore.exe
C:\WINDOWS\SnoopFreeUI.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\k11940028342.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
C:\HJT\Administrator.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070418.dll start
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SnoopFreeUI] SnoopFreeUI.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [GenProtect] C:\WINDOWS\GenProtect.exe
O4 - HKLM\..\Run: [Kvsc3] C:\WINDOWS\Kvsc3.exe
O4 - HKLM\..\Run: [AVPSrv] C:\WINDOWS\AVPSrv.exe
O4 - HKLM\..\Run: [MsIMMs32] C:\WINDOWS\MsIMMs32.exe
O4 - HKLM\..\Run: [NVDispDrv] C:\WINDOWS\NVDispDrv.exE
O4 - HKLM\..\Run: [cmdbcs] C:\WINDOWS\cmdbcs.exe
O4 - HKLM\..\Run: [MsPrint32D] C:\WINDOWS\MsPrint32D.exe
O4 - HKLM\..\Run: [msccrt] C:\WINDOWS\msccrt.exe
O4 - HKLM\..\Run: [DbgHlp32] C:\WINDOWS\DbgHlp32.exe
O4 - HKLM\..\Run: [ALMJ] C:\WINDOWS\system32\ALMJ.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1120979109812
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Snoop Free Service (SnoopFreeSvc) - Unknown owner - C:\WINDOWS\System32\SnoopFreeSvc.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)


-- HijackThis Fixed Entries (C:\HJT\backups\) ----------------------------------

backup-20050814-185530-101 O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
backup-20050814-185530-197 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.bestwebslinks.com/
backup-20050814-185530-271 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.bestwebslinks.com/search.php?qq=%1
backup-20050814-185530-491 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.bestwebslinks.com/search.php?qq=%1
backup-20050814-185530-574 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.bestwebslinks.com/search.php?qq=%1
backup-20050814-185530-834 O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\system32\msmsgs.exe
backup-20051227-160935-217 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
backup-20051227-160935-437 O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
backup-20051227-160935-520 O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
backup-20051227-160935-612 O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
backup-20060902-103504-702 O2 - BHO: ????????? - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Progra~1\Baidu\bar\BaiDuBar.dll
backup-20060902-103505-129 O8 - Extra context menu item: ???-????MP3 - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUMP3.HTM
backup-20060902-103505-452 O8 - Extra context menu item: ???-???????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUPOST.HTM
backup-20060902-103505-586 O8 - Extra context menu item: ???-???????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUNEWS.HTM
backup-20060902-103505-609 O8 - Extra context menu item: ???-??????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDU_DIC.HTM
backup-20060902-103505-629 O8 - Extra context menu item: ???-??????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDULYRIC.HTM
backup-20060902-103505-719 O8 - Extra context menu item: ???-?????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUIMG.HTM
backup-20060902-103505-830 O3 - Toolbar: ????????? - {B580CF65-E151-49C3-B73F-70B13FCA8E86} - C:\Progra~1\Baidu\bar\BaiDuBar.dll
backup-20060902-103505-918 O8 - Extra context menu item: ???-??????? - res://C:\Progra~1\Baidu\bar\BaiDuBar.dll/BAIDUSEARCH.HTM
backup-20070204-140923-443 O2 - BHO: Yahoo ToolBar - {BE756CFF-ADB4-4bc5-A35F-19E546E5710E} - C:\WINDOWS\system32\winnet.dll (file missing)
backup-20070204-140924-124 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-140924-177 O21 - SSODL: DCOM Server 3339 - {2C1CD3D7-86AC-4068-93BC-A02304BB3339} - C:\WINDOWS\system32\uirxihi.dll (file missing)
backup-20070204-140924-391 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)
backup-20070204-140924-469 O4 - HKLM\..\Run: [ChkDisk] C:\WINDOWS\system32\chk_disk.exe
backup-20070204-140924-689 O4 - HKLM\..\Run: [mstds.exe] c:\windows\system32\mstds.exe
backup-20070204-140924-864 O20 - Winlogon Notify: instcat - instcat.dll (file missing)
backup-20070204-141350-324 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)
backup-20070204-141350-344 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-141632-343 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)
backup-20070204-141632-612 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-141945-146 O23 - Service: msupdatefs (Microsoft Updater FileSystem) - Unknown owner - C:\WINDOWS\system32\update13428241.exe (file missing)
backup-20070204-141945-876 O23 - Service: Windows Task Manager (Taskmng) - Unknown owner - C:\WINDOWS\system32\taskmang.exe (file missing)

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 sfsync02 (StarForce Protection Synchronization Driver (version 2.x)) - c:\windows\system32\drivers\sfsync02.sys <Not Verified; Protection Technology; StarForce Protection System>
R0 SnoopFree (SnoopFree Driver) - c:\windows\system32\drivers\snopfree.sys
R3 cmudax (C-Media High Definition Audio Interface) - c:\windows\system32\drivers\cmudax.sys <Not Verified; C-Media Inc; C-Media Audio Driver (WDM)>
R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
R3 Pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

S2 ntio256 (Input and output operations) - c:\windows\system32\ntio256.sys (file missing)
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
S3 EXAMPLE1 - c:\windows\system32\ksys.sys (file missing)
S3 genmcmn (Scroll Mouse Driver) - c:\windows\system32\drivers\gmfiltr.sys (file missing)
S3 NPF (Netgroup Packet Filter) - c:\windows\system32\drivers\npf.sys <Not Verified; CACE Technologies; WinPcap Netgroup Packet Filter Driver>
S3 npkcrypt - c:\program files\lineageii\system\npkcrypt.sys (file missing)
S3 scsk4 (SCSK4 Driver Service) - c:\windows\system32\drivers\scsk4.sys <Not Verified; SoftCamp Co., Inc.; SoftCamp Secure KeyStroke>
S3 XDva004 - c:\windows\system32\xdva004.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 SnoopFreeSvc (Snoop Free Service) - system32\snoopfreesvc.exe

S2 10DA1C34 - c:\windows\system32\30b9f538.exe -k <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
S3 ServiceLayer - "c:\program files\common files\pcsuite\services\servicelayer.exe" <Not Verified; Nokia.; PC Connectivity Solution>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Realtek RTL8169/8110 Family Gigabit Ethernet NIC
Device ID: PCI\VEN_10EC&DEV_8169&SUBSYS_18531019&REV_10\4&23C0B1C&0&50F0
Manufacturer: Realtek Semiconductor Corp.
Name: Realtek RTL8169/8110 Family Gigabit Ethernet NIC
PNP Device ID: PCI\VEN_10EC&DEV_8169&SUBSYS_18531019&REV_10\4&23C0B1C&0&50F0
Service: RTL8023


-- Scheduled Tasks -------------------------------------------------------------

2007-11-02 21:00:00 350 --a------ C:\WINDOWS\Tasks\At22.job
2007-11-02 20:58:00 270 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
2007-11-02 20:01:37 350 --a------ C:\WINDOWS\Tasks\At21.job
2007-11-02 06:01:00 350 --a------ C:\WINDOWS\Tasks\At7.job
2007-11-02 05:01:00 350 --a------ C:\WINDOWS\Tasks\At6.job
2007-11-02 04:01:00 350 --a------ C:\WINDOWS\Tasks\At5.job
2007-11-02 03:01:00 350 --a------ C:\WINDOWS\Tasks\At4.job
2007-11-02 02:01:00 350 --a------ C:\WINDOWS\Tasks\At3.job
2007-11-02 01:01:00 350 --a------ C:\WINDOWS\Tasks\At2.job
2007-11-02 00:01:00 350 --a------ C:\WINDOWS\Tasks\At1.job
2007-11-01 23:01:00 350 --a------ C:\WINDOWS\Tasks\At24.job
2007-11-01 22:01:00 350 --a------ C:\WINDOWS\Tasks\At23.job
2007-11-01 17:01:47 350 --a------ C:\WINDOWS\Tasks\At18.job
2007-10-29 08:01:54 350 --a------ C:\WINDOWS\Tasks\At9.job
2007-10-28 19:01:00 350 --a------ C:\WINDOWS\Tasks\At20.job
2007-10-28 18:01:00 350 --a------ C:\WINDOWS\Tasks\At19.job
2007-10-28 16:01:00 350 --a------ C:\WINDOWS\Tasks\At17.job
2007-10-28 15:01:00 350 --a------ C:\WINDOWS\Tasks\At16.job
2007-10-28 14:01:00 350 --a------ C:\WINDOWS\Tasks\At15.job
2007-10-28 13:01:31 350 --a------ C:\WINDOWS\Tasks\At14.job
2007-10-27 12:01:00 350 --a------ C:\WINDOWS\Tasks\At13.job
2007-10-27 11:01:00 350 --a------ C:\WINDOWS\Tasks\At12.job
2007-10-27 10:01:46 350 --a------ C:\WINDOWS\Tasks\At11.job
2007-10-27 07:01:00 350 --a------ C:\WINDOWS\Tasks\At8.job
2007-10-18 16:04:58 350 --a------ C:\WINDOWS\Tasks\At10.job


-- Files created between 2007-10-02 and 2007-11-02 -----------------------------

2007-11-02 20:56:51 2214 --a------ C:\WINDOWS\system32\SHQMANGR.DLL
2007-11-02 20:56:51 22920 --a------ C:\WINDOWS\system32\LYLOADMR.EXE
2007-11-02 20:24:08 73 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys
2007-11-02 20:24:08 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware>
2007-11-02 19:36:54 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-11-02 19:36:52 0 d-------- C:\WINDOWS\LastGood
2007-11-02 19:32:36 20480 --a------ C:\WINDOWS\system32\upxdnd.dll
2007-11-02 19:32:36 12564 --a------ C:\WINDOWS\MsPrint32D.exe
2007-11-02 19:31:33 13152 --a------ C:\WINDOWS\NVDispDrv.exE
2007-11-02 19:31:27 125440 --a------ C:\WINDOWS\system32\xhppcu.dll
2007-11-02 19:29:16 14416 --a------ C:\WINDOWS\GenProtect.exe
2007-11-02 19:29:15 14416 --a------ C:\WINDOWS\system32\k11940028342.exe
2007-11-01 19:28:19 18432 --a------ C:\WINDOWS\system32\k11939163176.exe
2007-11-01 19:28:17 17408 --a------ C:\WINDOWS\system32\k11939163133.exe
2007-11-01 19:28:16 14416 --a------ C:\WINDOWS\system32\k11939163122.exe
2007-11-01 19:28:15 16012 --a------ C:\WINDOWS\system32\k11939163144.exe
2007-11-01 19:23:56 26112 --a------ C:\WINDOWS\system32\kosntc.dll
2007-11-01 17:07:44 16384 --a------ C:\WINDOWS\system32\vdjkbf58.dll <Not Verified; ; Autolive Dynamic Link Library>
2007-11-01 17:07:35 0 d-------- C:\Program Files\symp
2007-11-01 17:07:32 202468 --a------ C:\WINDOWS\system32\drivers\acpidisk.sys
2007-11-01 16:57:31 23040 --a------ C:\WINDOWS\system32\gdvtwx.dll
2007-11-01 16:57:29 17408 --a------ C:\WINDOWS\system32\k11939072683.exe
2007-11-01 16:57:28 14416 --a------ C:\WINDOWS\system32\k11939072672.exe
2007-11-01 16:54:25 16896 --a------ C:\WINDOWS\ekyfgc.exe
2007-10-31 22:40:30 16012 --a------ C:\WINDOWS\system32\k11938414494.exe
2007-10-31 22:40:27 16896 --a------ C:\WINDOWS\system32\k11938414462.exe
2007-10-31 00:16:10 7864320 --a------ C:\Documents and Settings\Administrator\ntuser.dat
2007-10-30 22:03:55 42496 --a------ C:\WINDOWS\system32\SHQ.DLL
2007-10-30 22:03:54 20 --a------ C:\WINDOWS\system32\mhsha1.dat
2007-10-30 20:42:24 16384 --a------ C:\WINDOWS\system32\k119374790215.exe
2007-10-30 20:42:21 30796 --a------ C:\WINDOWS\system32\k119374790013.exe
2007-10-30 20:15:21 16384 --a------ C:\WINDOWS\system32\k119374628015.exe
2007-10-30 01:38:38 16384 --a------ C:\WINDOWS\system32\k119367927815.exe
2007-10-30 00:52:01 5632 --a------ C:\WINDOWS\system32\MJHOOK.DLL
2007-10-30 00:52:01 16384 --a------ C:\WINDOWS\system32\k119367648015.exe
2007-10-30 00:52:01 3072 --a------ C:\WINDOWS\system32\ALMJDLL.DLL
2007-10-30 00:52:01 16384 --a------ C:\WINDOWS\system32\ALMJ.exe
2007-10-30 00:51:59 18944 --a------ C:\WINDOWS\system32\DbgHlp32.dll
2007-10-30 00:51:59 15360 --a------ C:\WINDOWS\DbgHlp32.exe
2007-10-30 00:51:58 27648 --a------ C:\WINDOWS\system32\msccrt.dll
2007-10-30 00:51:58 20480 --a------ C:\WINDOWS\msccrt.exe
2007-10-30 00:51:57 19456 --a------ C:\WINDOWS\system32\MsPrint32D.dll
2007-10-30 00:51:55 26112 --a------ C:\WINDOWS\system32\cmdbcs.dll
2007-10-30 00:51:55 19456 --a------ C:\WINDOWS\cmdbcs.exe
2007-10-30 00:50:53 18944 --a------ C:\WINDOWS\system32\NVDispDrv.dll
2007-10-30 00:50:52 24064 --a------ C:\WINDOWS\system32\MsIMMs32.dll
2007-10-30 00:50:52 18432 --a------ C:\WINDOWS\MsIMMs32.exe
2007-10-30 00:50:50 26112 --a------ C:\WINDOWS\system32\mppds.dll
2007-10-30 00:50:49 25088 --a------ C:\WINDOWS\system32\AVPSrv.dll
2007-10-30 00:50:49 16012 --a------ C:\WINDOWS\AVPSrv.exe
2007-10-30 00:50:48 23040 --a------ C:\WINDOWS\system32\Kvsc3.dll
2007-10-30 00:50:48 17408 --a------ C:\WINDOWS\Kvsc3.exe
2007-10-30 00:50:47 125440 --a------ C:\WINDOWS\system32\GenProtect.dll
2007-10-30 00:50:44 5968 --a------ C:\WINDOWS\system32\MSDEG32.DLL
2007-10-30 00:50:44 3526 --a------ C:\WINDOWS\system32\LYMANGR.DLL
2007-10-30 00:47:41 40960 --a------ C:\WINDOWS\system32\C86728B4.DLL <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
2007-10-30 00:47:39 18989 --a------ C:\WINDOWS\system32\30B9F538.EXE <Not Verified; Microsoft Corporation; Microsoft(R) Windows(R) Operating System>
2007-10-29 08:12:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\WZCN
2007-10-29 08:12:36 0 d-------- C:\Program Files\WZCN
2007-10-29 08:12:00 24832 --ahs---- C:\WINDOWS\system32\system.dat
2007-10-26 19:33:45 0 d-------- C:\Program Files\SealOnlineUSA
2007-10-26 19:33:37 65536 --a------ C:\WINDOWS\IFinst27.exe


-- Find3M Report ---------------------------------------------------------------

2007-11-02 20:24:08 502784 --a------ C:\WINDOWS\system32\winlogon(2)(2).exe <Not Verified; Microsoft Corporation; Microsoft? Windows? Operating System>
2007-11-02 20:07:49 0 d-------- C:\Program Files\MSN Messenger
2007-11-02 20:02:36 0 d-------- C:\Program Files\Google
2007-11-02 20:02:10 0 d-------- C:\Program Files\ewido anti-spyware 4.0
2007-11-02 20:02:05 0 d-------- C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor
2007-11-01 21:03:32 0 d-------- C:\Program Files\Steam
2007-09-22 02:01:21 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-09-22 02:00:51 0 d-------- C:\Program Files\LineageII
2007-09-14 15:53:21 0 d-------- C:\Program Files\7-Zip
2007-09-13 22:15:31 0 d-------- C:\Program Files\Scions of Fate
2007-09-13 11:16:56 0 d-------- C:\Program Files\Windows Live Toolbar
2007-09-13 10:11:40 0 d-------- C:\Program Files\Real
2007-09-09 00:42:43 184320 --a------ C:\WINDOWS\system32\KKIgQhmd.dll <Not Verified; ; WebAssist>
2007-09-09 00:02:38 184320 --a------ C:\WINDOWS\system32\612fd7We.dll <Not Verified; ; WebAssist>
2007-09-07 19:11:39 184320 --a------ C:\WINDOWS\system32\paoOFVhn.dll <Not Verified; ; WebAssist>
2007-09-06 13:11:01 184320 --a------ C:\WINDOWS\system32\Y5pyg500.dll <Not Verified; ; WebAssist>


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SnoopFreeUI"="SnoopFreeUI.exe" [09/03/2006 08:48 PM C:\WINDOWS\SnoopFreeUI.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [06/15/2005 05:20 PM]
"GenProtect"="C:\WINDOWS\GenProtect.exe" [11/02/2007 07:31 PM]
"Kvsc3"="C:\WINDOWS\Kvsc3.exe" [11/02/2007 07:31 PM]
"AVPSrv"="C:\WINDOWS\AVPSrv.exe" [11/02/2007 07:31 PM]
"MsIMMs32"="C:\WINDOWS\MsIMMs32.exe" [11/02/2007 07:32 PM]
"NVDispDrv"="C:\WINDOWS\NVDispDrv.exE" [11/02/2007 07:31 PM]
"cmdbcs"="C:\WINDOWS\cmdbcs.exe" [11/02/2007 07:32 PM]
"MsPrint32D"="C:\WINDOWS\MsPrint32D.exe" [11/02/2007 07:32 PM]
"msccrt"="C:\WINDOWS\msccrt.exe" [11/02/2007 07:32 PM]
"DbgHlp32"="C:\WINDOWS\DbgHlp32.exe" [11/02/2007 07:31 PM]
"ALMJ"="C:\WINDOWS\system32\ALMJ.exe" [10/30/2007 08:42 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [01/19/2007 12:54 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"xp_system"=C:\WINDOWS\inet20126\winlogon.exe
"Recoveru systems"=C:\WINDOWS\TEMP\svchast.exe
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [12/14/2004 7:44:06 PM]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [7/11/2005 4:16:25 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [7/11/2005 4:44:20 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"DisableTaskMgr"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"MSDEG32"=LYLoader.exe
"MSDWG32"=LYLoadbr.exe
"MSDCG32 "=LYLeador.exe
"MSDOG32"=LYLoador.exe
"MSDSG32"=LYLoadar.exe
"MSDMG32"=LYLoadmr.exe
"MSDHG32"=LYLoadhr.exe
"MSDQG32"=LYLoadqr.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{267709FD-A691-43B0-BF38-0DF6887A9B44}"= C:\WINDOWS\winpsfisle.dll [ ]
"{27BFC5FD-CF65-4C1A-B2C3-FD508A9FDE51}"= C:\WINDOWS\debug\userMode\F9B394.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,rundll32.exe C:\WINDOWS\system32\winsys16_070418.dll start"




-- End of Deckard's System Scanner: finished at 2007-11-02 21:02:44 ------------

Relevance 100%
Preferred Solution: Strange pop up keep coming back

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

Answer: Strange pop up keep coming back

please ignore this thread.. Have already sent computer to repair as it goes down...

1 more replies
Relevance 67.65%

Hey guys, I'm new here.

I have always had a pretty clean system and never even needed to download hijackthis until today because I had a pesky problem that was annoying me with popup alerts in AntiVir (Vundo...ssttt.dll). So I ran vundofix and a couple other things and it seems to be gone. But now that I've got hijackthis, I noticed something I thought I'd ask about. I see a list of host IP's and banking related sites and such. I have no idea what this is, but I suspected a virus. So I googled and found 9 results, but they were all in German, mostly at the hijackthis.de site. Since my knowledge of germanic languages is "Ja" and "Gutentag", I found no help there, even with the pages badly translated.

So I thought I'd post here, here's the latest log, please let me know what needs to be done.

hijackthis log said:

Logfile of HijackThis v1.99.1
Scan saved at 5:40:10 PM, on 10/7/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Syste... Read more

Answer:Strange list of IP hosts in hijackthis / How to prevent svcchost from coming back?

6 more replies
Relevance 67.24%

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by SteeL at 16:27:38 on 2011-12-12
Microsoft Windows 7 Ultimate 6.1.7600.0.1250.385.1033.18.4094.2360 [GMT 1:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:&#... Read more

Answer:Please help, cycbot.b infection, firewall not working. Some strange proxy settings keep coming back

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/432052 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

2 more replies
Relevance 55.35%

I've been having a a problem with the back left corner hinge since October of last year I poisted to another board about this problem hving been told that this issue would be passed onto support in my region. I'm currious as to weather I'll hear from these people in this lifetime or the next. I enjoy my Laptop and would like to continue using it but as time goes on it keeps seperating more and more and I have to snap it back into place to keep in together. I'm hoping to actually hear back from someone this time that will be able to help me in fixing this issue.

Answer:Back Corner coming from the back left side by the hinge

@jmb1313

 

I have brought your issue to the attention of an appropriate team within HP. They will likely request information from you in order to look up your case details or product serial number. Please look for a private message from an identified HP contact. Additionally, keep in mind not to publicly post personal information (serial numbers and case details).

If you are unfamiliar with how the Forum's private message capability works, you can learn about that here.

Thank you for visiting the HP Support Forum.

1 more replies
Relevance 53.71%

I already posted in How to remove Windows 10 upgrade updates in Windows 7 and 8
In this thread after the starting post from Tookeri other updates that had to be deleted were mentioned. I made a list in post 841
I did not have all these updates on the pc but those that were on it I hid.
Some of them came back and I hid them again.
Now today they are back - with some that I had not seen before.

I made an attachment that shows them and also shows that I hid them again

Will I have to check Windows Update for the rest of my live?????

More replies
Relevance 52.89%

Hello,
I have a problem ,which ive tried to fix serveral times but it keeps coming back.
This virus is located in Systems 32 folder, Pc Cilling 2005 identified it as TROJ_ROOTKIN.N . Ive gone
to safe mode, deleted it, returned to windows and the virus reapeared, wats more it clogs up Pc Cillin, so now under quarantine i have 100+ instances of this virus, and its increasing.
The virus is labelled hpr34k8

Im sure my Hijack Log is fairly clean... -------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 5:27:53 PM, on 14/08/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe
C:\Program Files\Telstra\Cable Login\bpcable.exe
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Telstra\Toolbar\bpumTray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin... Read more

Answer:Virus that keeps coming back and back and back, so on

bump, hopefully someone takes notice

19 more replies
Relevance 50.02%

I am using Windows 8 - Firefox browser. Just recently I have been getting a page up with this address:

http://dft.pathmapping.net/sd/wrap-....net/sd/apps/fusionx/0.0.3.html?aff=1060-8102 when I try to access a web page.

I then have to delete this page and go on to a page I wanted to access. What is this? I've never had this happen in the past - just started today.

Any help to eliminate this would be appreciated.
 

Answer:Strange page coming up

12 more replies
Relevance 50.02%

Hi,
My PC has for a while been making a short brief 'click' noise at random times when it is running. It is the same 'click' that is heard when it first booted up. I am wondering if the hard drive is on it's way out or maybe the fan needs replacing. The noise is not continous and happens maybe a few times a week.

I bought the comp back in 2002 and the specs aren't so happy either:

HP Pavilion 7925
Windows XP Home Edition SP2
AMD Athlon 'Thunderbird' 1,200 MHz
640MB RAM
GeForce 6200 256MB

Everything else seems to be fine, apart from the power loss upon reboot a couple of weeks ago. However the fan did once cause the power to go temporarily when it got jammed but it got fixed.

I don't know if buying new HD and a new OS would be more worthwhile
Maybe it's time to replace her altogether?

Answer:Strange sound coming from PC

I would think the problem could be cause by a broken fan, although I am no hardware expert.

3 more replies
Relevance 50.02%

HII i have dell 1525 inspiron notebook and few days back when i strated it ...it showed blue screen with message physical dump .
now
after that i run the diagnostic test and found that there are some bad sectors on the hard disk bec of which the system is not able to boot properly.

i replaced the harddisk and tried to get my data back from that harddisk
that harddisk is now out and tried to connect it to desktop using sata powercable but the harddisk show both the drives but the files are not accessed and not visible and i am getting the following error .

"unable to mount location DBus error org .freedeskto.DBus.Error.NoReply: Did not receive a reply . Possible causes include : the remote application did not send a reply, the message bus security policy blocked the reply, the reply timeout expired, or the network connection was broken. "

so guys tell how to recover my data as it has very imp data in it..
 

Answer:Strange problem coming

me at also
thankx
 

3 more replies
Relevance 50.02%

Hi,I was wondering if anyone might be able to help me here.I have a PC desktop used as a web-server in the office. It was working fine til recently one day when i came to the office early in the morning, i heard a noise coming from the desktop box. The noise, if i can describe, is like the sound of siren in times of emergency. It's not beeping. Honestly, this is my first time i heard the noise like that. Not sure what caused it to trigger that noise and happy if anyone encountered this problem before, might be able to share it with me. BTW, the system is AMD Athlon(TM)XP, 1.61 Ghz, 256M RAM, windows XP Pro.Thank you very much in advance

Answer:Strange noise coming from my PC

Seems like it may be fan related, take the covers off and see if you can pin-point the noise, could be a wire or cable has moved and is touching fan blades

9 more replies
Relevance 49.61%

I keep seeing this error message pop up every half hour or so(picture below). I searched my pc for a program called playto and I found some game program and uninstalled it assuming it would solve them problem, but that didnt help. I'm not sure what this message means. It looks like some program is trying to update and it cant find the updater.dll. I dont know how to fix this though. If anyone has any suggestions please help.

C:\Users\Owner\AppData\Local\PLAYTO~1\Updater.dll

Answer:Strange Error Message Keeps Coming Up

Open Windows Explorer. Press Alt, click View. Put a check box in Show Hidden Items
Browse to C:\Users\Owner\AppData\Local is there a folder named PLAYTO if so, right click and Delete it.

6 more replies
Relevance 49.61%

so...
i have a problem with my 'hdd2' i think i have Qosmio G20-127
it all started yesterday ... and now its like this (http://www.youtube.com/watch?v=D3Pzea1xMR8) this noise is making me sic.

Please help me and tell me what to do to get rid of it...

thanks.

Answer:Qosmio G20-127: very strange noise coming from HDD

if you are shure, that the noise comes frome the hdd, i would strongly recommend to save all your data. it's mostly a indication that the hdd will break down... then you should contact a service partner, to check the whole unit. he is able, to find out, if the noise is related to the hdd and if necessary, to take the next steps.

br, Ben

2 more replies
Relevance 49.61%

I'm going to try to explain this the best I can. Anytime my computer is doing something, (sounds like it's only from a select number of programs) I can hear a weird low volume (but still very noticeable) screeching noise that gets higher in pitch. It only lasts about 3-4 seconds and sometimes happens again immediately. Sounds like it's either the HDD or...network traffic. (I know it sounds weird.) For example when updating Avast antivirus definitions. Anyways here's my specs if they help.

Asus K8N-VM Micro ATX Mobo
AMD Sempron 2600+ 1.6Ghz Single Core CPU (Socket 754)
1GB DDR RAM
320GB WD Caviar Blue HDD
Nvidia Geforce 7600GS (PCI-E)
Windows XP Home Edition

Don't worry I'll be upgrading all this soon, (except for the HDD) it's just that I don't have a job and I'm a little short on money (Upgrades would cost about $350.00 off Newegg.)

Answer:Very strange sound coming from computer

to Bleeping Computer, sjvirchow.

I've experienced something similar to this before on my Mom's old Acer laptop...if you had the wireless turned on and closed the lid, it would make this high-pitched noise...turn off the wi-fi, doesn't do it. It appeared to be some sort of interference between the wireless card and some component of the lid.

This may or may not be the same thing you are experiencing.

I doubt it is the hard drive, in your case...a hard drive making that kind of noise could not function for long without blowing up.

Is the sound coming out of the speakers or can you narrow it down to a particular place around the case? Try turning off various components, and see if you can narrow down what could be causing it.

Could it be caused by your fan(s)? Try thoroughly blowing out the case with a can of compressed air.

15 more replies
Relevance 49.61%

This is a very weird and rather annoying problem I have. I bought some Insignia speakers about a year 1/2 ago and they worked fine. After moving to a new house, I have very strange music coming from my speakers that sounds like a radio station. In fact, I'm sure it's a radio station and some how the speakers have managed to pick up it's signal and play very very faint music through them.

It has been going on since I moved (4 months) and I just ignored it for the first few months as it was barely audible. Recently, I have purchased some very nice ear buds and use them to play games, but the music is very noticeable and annoying while doing so. If I want to use these headphones for gaming I am going to have to fix this problem.

The music will play regardless of the level of volume the speakers are at. It is very faint and clearly a radio station. What would some solutions to this be? I have researched it somewhat and some people have said keep it away from metallic objects or something of the sort that could attract radio waves. Well, my computer is the exact same setup as it was at my previous address which gave me no problems.

If I bought different speakers could I expect the same thing? Any help would be appreciated as this is a very annoying problem.

More replies
Relevance 49.61%

I noticed twice a strange noise coming out of my Satellite L40
About one or two seconds there was a sound that sounded a bit like the noise that you hear when you use a analog dial up modem and are trying to connect.

It came out of the blue and I am using a wireless ADSL connection.
The sound of my notebook was off.

Does anyone noticed the same thing or do you know what it could be?

Answer:Strange noise coming out of my Satellite L40

I have the same strange noise. It happens sometime like you said - out of the blue. It sounds like dial-up modem but I also have a feeling it sounds like a hard disk with a problem - something clicking for a second or two (it's a brand new notebook that I bought about 40 days ago and I don't do any heavy work on it - some typing, Internet browsing and such things.

I would also want to know what is it. Especially if it can harm my data some day...



PS Why this strange message for registered users?
"Please note, your reply will need to be approved by a moderator before it is posted in the forum."

2 more replies
Relevance 49.61%

I have Windows XP Professional SP3 Version 2002

HDD Seagate with 7200 rpm, 8 MB Serial ATA
ATI Radeon PCI-Express, x550, 256 MB DDR(128 bit)
Pentium 4 CPU 3.00 Ghz, bus 800, s.775, 1 mb, 64 bits
Intel 915-P, s.775, FSB 800, Serial ATA, PCI-E, Dual DDR400, ATX, GA - 8i915pl-g.

The problem is like that : I get a super-scarry sound coming out from my hardware parts, not from my sound system. It's like the sound of the computer when you press multiple keyboard buttons, but this sound is louder and longer[5-6 secs] and appears when I play Tomb Raider. I played it before, but no problems. Recently i installed myself a 512 Ram, and there started the sounds, i guess... Should i ignore them ? Or not to play anymore ? My PC will break?

I probably should buy another fan, but i visited some profile-sites, and there are lots of fans. For CPU, for one, for another...I don't know what to buy, if i should buy one... :-??
 

Answer:Solved: Strange noise coming from nowhere...:-??

The sound is probably coming from the internal speaker of your computer. This is a way for your computer to "complain" about something, to report a problem.

Open your case and try locating the sound source. Internal speakers are usually mounted on the case and connected to the motherboard. If you can't locate a speaker, look for a small rubber-like cylinder object, this could be the speaker as well.

Now, if you are sure that the sound comes from the speaker, we must identify the error code (aka the sound). Check the manual of your motherboard, you can usually find details regarding BIOS error codes there...Or try the manufacturer's website.

Upgrading RAM can cause problems. However, in that case you wouldn't be able to start your computer at all or you would be getting other error messages as well (like the infamous Windows Blue Screens of Death)...

IMO, your computer complains about overheating since the sound starts when you run games. You may accidentally moved the CPU heatsink while installing the RAM stick, who knows? Next time you hear this sound quit the game, restart and enter the BIOS in order to check the CPU temperature.

You can enter the BIOS by pressing a certain key (usually the DEL key) while the computer boots up. You will see a message like "Press DEL to enter Setup" on the POST screen, the first screen that appears when you start your machine, where information about your CPU, RAM and drives is displayed.

Once in th... Read more

1 more replies
Relevance 49.61%

Sometimes when I use my computer, a strange kind of whirring sound starts to happen. It will go away if I move my computer but im not really sure why its happening or what it is. I've noticed a performance loss since this has happened. Anyone know what it is and how i can fix it?

Answer:strange sound coming from computer?

I would suggest opening the cover and trying to isolate where the sound is coming from.Someone in the past reported a similar problem, but I think he said his computer "glowed" also.

1 more replies
Relevance 49.61%

I JUST got highspeed yesterday, and upon loading up my computer this morning I got a strange message during startup. I hit printscreen, and here's what I saw:

A black box on my desktop, with the heading:

C:\PROGRA~1\INTERN~2\UPDATE\OPTIMI~1.EXE

Nothing was written in the box.

But a message box came up saying:

Heading:
16 bit MS-DOS Subsystem

And then:

C:\PROGRA~1\INTERN~2\UPDATE\OPTIMI~1.EXE
The NTVDM CPU has encountered an illegal instruction
CS: 0537 IP: fff5 OP: ff f8 ff fa ff Choose close to terminate the application.

What is this, and how can I get rid of it?

Also, when I turned on my computer I had a strange new feature on the internet explorer address bar, and something called 180searchassistant or something like that (I removed it using add/remove programs, but I don't think I had it last night).
 

Answer:Strange screen coming up on startup

6 more replies
Relevance 49.61%

When I just press the start button in CPU and when it starts sometimes a sound comes from it..previously also a sound used to come.... the sound of fan but recently its making loud sound... all the other things are fine. i can use my PC normally but the sound is worrying me.... . most probably its the sound of the fan.... but why does it make so loud sound sometimes?? its not that it always happens but when it does it makes me afraid... please help
 

Answer:Solved: Strange sound coming from CPU?

16 more replies
Relevance 49.61%

I've managed to get rid of a lot of trojans and viruses during the post two days but there is only one thing left. I have no clue how to get rid of it at all and it just seems to be adware but it gets blocked each time by Malwarebytes. I really need help now as its starting to get really annoying and I feel unsafe actually using my computer because of it.
http://imgur.com/mvs8uKV Link to what it looks like.
 
Anyway my FRST notes.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:30-12-2015
Ran by Jake (administrator) on JAKE-PC (31-12-2015 00:21:05)
Running from C:\Users\Jake\Downloads
Loaded Profiles: Jake & DefaultAppPool (Available Profiles: Jake & DefaultAppPool)
Platform: Windows 10 Pro Version 1511 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(... Read more

Answer:Strange adware coming from regsvr32.exe

bump

11 more replies
Relevance 49.61%

Hey guys,

Basically, occasionally when I open up a tab in google chrome, I get this weird alien noises from my speakers. Its at 100% volume and loops until i close that tab.

In the sound tray, it says it is coming from chrome. I have no extensions or anything like that in Chrome, and I have done a virus search with norton 360 without much help. Any ideas?

It can be quite annoying late at night when i get this incredibly loud sound coming through, it sounds like an alien mothership or something like that.

If you guys need any info on my computer, just shout

Thanks for any help at all

Charlie
 

Answer:Strange noise coming from speakers.. help?

Download and save DDS to your Desktop from either of the following links:

http://download.bleepingcomputer.com/sUBs/dds.scr
http://compendiate.net/sUBs/dds/dds.scr

Double click DDS to run the scan, Vista or Windows 7 user accept UAC alert.
There will be an alert that two logs will be saved to the Desktop, DDS.txt and Attach.txt
Copy and paste those two logs to your reply when the scan is complete....

Kevin....
 

3 more replies
Relevance 49.61%

I am having unusual noises coming from my computer, like I am frying a steak or something. It's not very loud and strong but its continous since about an hour ago. I tried restarting but it came back. Any possible suggestions please?

Answer:Strange noises coming from computer

HDD Clappered,Or even a fan....But ensure its not the hdd first.Remove the internal power cable from the HDD, and see if it is quiet.

10 more replies
Relevance 49.61%

Hello all,

When I start up GTA IV (purchased through Steam) on my PC, there is a high-pitched whining noise coming from my PC. I've tried to open up the side panel while this is occurring to try and narrow down where this noise may be coming from. I'm still not a 100% sure, but my best guess at the moment is my GPU. I've tried cranking down the Graphics but that doesn't change the noise at all. And the second I switch back to my desktop (even if the game is still running) the noise goes away.

I ran FurMark in bench marking mode to stress-test the GPU. The noise isn't quite the same during that test, but it is close. The only difference is, during that test, the pitch of the noise changes going up and down every few seconds. When I play GTA IV, the noise is present while the game is loading and for the first minute or so while playing. It appears to go away after that point and may return occasionally after that.

Does anyone have any idea what this noise is and how I can stop it? I've done some research online and a few people have mentioned coil-whining. Could this be the cause? I'd sure appreciate any help on this one.

EDIT: I should also mention, this is a problem that has arisen over the last 2 or 3 days. I don't recall hearing this noise when I first installed GTA IV and tried it out (probably 3-4 weeks ago).

Here are my system specs:

CPU: Intel Core i7-4770K 3.5GHz Quad-Core Processor
CPU Cooler: Corsair H100i 77.0 CFM Liquid CPU Cooler
Motherboard: ASRock Z87 ... Read more

Answer:Strange noise coming from PC when I play GTX IV

What have you changed in the last few days? How old is your PSU?

I have that happen to me all the time when I load up certain games. Mine is the GPU's spinning up to handle the game. No biggie (to me that is) as it's not going to hurt your GPU as long as the fans kick on when a load is put on it. I also have a fan controller, so I can push extra air around my cards when I'm playing as well.

8 more replies
Relevance 49.61%

Hiya, i have a HP pavillion notebook (dv1355EA) for well over a year now but in this last month ive heard a mosquito type noise coming from my speakers. The noise comes on and off but is getting more frequent, i either have to wait for it to stop or mute my speakers to get it to stop. It sometimes comes on slightly before the fans start up and stops when they stop, but sometimes the fans work without the noise.

It plays over any music or DVD i play but have noticed that it doesnt make the noise if i use the Quickstart Dvd without loading up windows. Have also at times noticed the hard drive loading noise coming through the speakers aswell which can be stopped by switching my speakers off.

Have reloaded all the original drivers and restarted a number of times but its still there. Have even tried to hoover out the fans to remove any dust i could. I was thinking that maybe the sound card is damaged in some way of that its maybe overheating, but im all out of ideas as the noise is still there. Any help would be greatly appreciated, thankyou!!
 

Answer:Strange noise coming from laptop..

Sounds like perhaps the switching P/S is being coupled into the sound. If it just started happening, it could be lose screws/shielding in the laptop causing the issue. It could also be one of the fans dying, since DC brushless fans can generate such interference if they're failing.
 

1 more replies
Relevance 49.2%

I think I may have finally scrubbed enough to keep the dll (IeBHOs.dll) from re-appearing, but the E2G folder keeps recreating itself. Any suggestions?

It's a friends system and had Norton on it. I installed NOD32 and PC Tools Spyware Doctor. Then read a few threads and ran HJT a few times and made some deletions that "may" have helped. I know that I managed to get rid of the TrojanDownLoader-AC2 but this E2G is stubborn.

Also ran SpySweeper many times in safe mode and in non-safe mode. Disables Spyware Doctor from auto load with windows as it seemed to be interefering with the Spy Sweeper scan.

Here's the latest HJT log:

Thanks in advance for any suggestions!

Charlie

Logfile of HijackThis v1.99.1
Scan saved at 6:51:15 PM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:E2G keeps coming back

Three threads are not needed for the same problem.
 

2 more replies
Relevance 49.2%

2 nights ago i was surfing the next and i starting getting reports such as :

Windows has detected spyware infection!
It is recomended to use special antispyware tools to prevent data loss. Windows will now download and install the most up-to-date antispyware for you
Click here to protect your computer from spyware!

and

Warning! Potential Spyware Operation!
Your computer is making unauthorized copies of your system and
Internet files. Run full scan now to pervent any unathorised access
to your files! Click here to download spyware remover ...

i started getting a lot of popups trying to send me to a site calling cookingluck (f3.cookingluck.com, f5.cookingluck.com, f7.cookingluck.com,
f9.cookingluck.com) i close them before they can finish loading.

Now i didnt do the smartest thing and i downloaded one of the "anti-spyware" things they told me too. "system-defender". well thats about when everything went from bad to worse, shell.dll was giving me hell, wowfax.dll was messing up. The control panel icon also disapeared and anything i tried to do with the system it wouldnt let me..pretty much telling me i didnt have administrative privliges.

So i came on this site and saw the self help page and was looking it over and saw the the "SmitFraud and It's Variants Removal Instructions" section fit my problem to a T, so i followed the steps exactly as they are written. I also got rid of the system defender. When i rebooted into norma... Read more

Answer:It just keeps coming back.....

Hi and welcome to TSF.

My name is Iain and I will be helping you clean your system.

You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your logs are clean. Remember that although your symptoms may vanish, this does NOT mean that your system is clean.

If there is anything you don't understand, please ask BEFORE proceeding with the fixes.

Please ensure that you follow the instructions in the order I have them listed.
We'll begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool: http://www.bleepingcomputer.com/comb...o-use-combofix
When the tool is finished, it will produce a report for you.
Please post C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

NOTE: Combofix prevents autorun of all CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.

12 more replies
Relevance 49.2%

Greetings everyone I need some help.

First off... I have followed all the proceedures listed on the READ ME thread that is asked and I STILL AM HAVING ISSUES.

I have Ad-Aware SE and with the VX add.

I have HiJackThis v1.99 and have followed the steps on that thread as well.

Here is the problem:

I run Ad-Aware everytime I log on, and even in safe mode. It finds beween 8 and 60 items. Mostly Malware and DataMiners. Then once I fix those I rescan and it comes up clean. However, I am still getting pop-ups, I have EnhanceMySearch, and when I log off and log back in... and re-run Ad-Aware I still have 8-60 items that show up and the same problem persists.

Can anyone help and point me in the right direction? It is a major annoyance. THANKS TO EVERYONE IN ADVANCE!!
 

Answer:It all just keeps coming back

Make sure you have HijackThis 1.99 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser, e-mail. Close before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT
 

11 more replies
Relevance 49.2%
Question: Back coming off?

My Lumia 640 is quite new and the back plastic panel writing logo is coming off the Microsoft logo has come off and some letters are coming away?
Is this normal?

More replies
Relevance 49.2%

Hello, after removing numerous malwares, str.sys keep coming back even though i removed it several times.Here's the log, thanks for your help.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:22:19 PM, on 7/16/2009Platform: Windows Vista SP1 (WinNT 6.00.1905)MSIE: Internet Explorer v7.00 (7.00.6001.18000)Boot mode: NormalRunning processes:C:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\system32\taskeng.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Toshiba\Utilities\KeNotify.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Symantec AntiVirus\VPTray.exeC:\Windows\System32\hkcmd.exeC:\Windows\System32\igfxpers.exeC:\Program Files\QuickTime\QTTask.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Synaptics\SynTP\SynToshiba.exeC:\Windows\system32\igfxsrvc.exeC:\Windows\ehome\ehtray.exeC:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exeC:\Program Files\Symantec AntiVirus\DoScan.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program... Read more

Answer:Str.sys keep coming back, help!

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

2 more replies
Relevance 49.2%
Question: Keeps coming back!

I thought I wiped it off already but it's back AGAIN! And my SpyBot S&D is missing all sorts of components so it's not working right and it's the only one that has found any. The Microsoft one found one and deleted it but SpyBot found 16 but only deleted 2 before running into problems. EliteBar is back also. Help again!
 

Answer:Keeps coming back!

- Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.
After doing ALL of the above you still have a problem:

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
 

3 more replies
Relevance 49.2%

Hello
For many years a succeeded in keeping my computers safe - then, not even a month ago, something surfaced. A Virut thing after I visited an insecure site.
If this can help, a few days before I had for the first time in my pc life installed a downloader program called Flashget-
Well I tried at first to clean up with Spybot and Spyware Doctor (who had not by the way intercepted the hostile item). But the machine had still a strange behaviour so I downloaded some Linux based Rescue CD .iso files (Kaspersky, BitDefender, WebDoctor), burned the CDs and went on scanning without Windows. Those found a wealth of infections by Trojans as well as by the Virut thing, so I kept cleaning and cleaning (desinfecting and/or deleting that is) until nothing more was found.
I then restarted Windows, uninstalled Flashget and installed Avast antivirus. Unfortunately when using my browser I started to get redirected to a "stolnik.net" whatever search I did. Plus Avast began to show infections spreading in the system by a "W32.Vitro" virus. So I tried again with the rescue CDs - Kaspersky found a couple issues but nothing else - and Avast still claiming I have the W32.Vitro everywhere.
At this point I used the VirutCF removal tool by Norton, but to no avail - there is no Virut infection in the machine.
I was beginning to get nervous so I downloaded the Combofix tool, disabled all and every anti-virus and -spyware - as requested - and tried to start Combofix: nothing happens... Read more

Answer:They keep coming back

If you truley have Virut the only real alternative is to do a complete wipe and reinstall. See boopme's post here:http://www.bleepingcomputer.com/forums/ind...t&p=1260380That will help you determine if you have virut, and if you do, what you need to do.

13 more replies
Relevance 49.2%

Everytime I run webroots spysweeper It finds a cws threat. I don't understand why it keeps popping up, even after I tell spysweeper to remove it. Someone want to help me....

Logfile of HijackThis v1.99.1
Scan saved at 7:44:30 PM, on 10/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
D:\programfiles\Spy Sweeper\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Eset\nod32kui.exe
D:\programfiles\Spy Sweeper\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
D:\programfiles\MicrosoftAntivirus\gcasServ.exe
C:\Program Files\QuickTime\qttask.exe
D:\programfiles\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
D:\programfiles\MicrosoftAntivirus\gcasDtServ.exe
C:\Program Files\LIUtilities\WinTasks\wintasks.exe
D:\programfiles\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.... Read more

Answer:CWS keeps coming back

8 more replies
Relevance 49.2%

This is my second attempt at help. I failed my first time and after reading the preparation guide here I am. I tried fixing it myself and loading MBAM and it says I have an infected regestry value, (Trojan.Agent) When I run the MBAM it says my computer must reboot to fix. It does, but then I have the same infection. I am confused, frustrated, and not really sure now what I am doing. Thankfully there are those here that can help...I am humbled.

Here is my DDS.txt
DDS (Ver_09-03-16.01) - NTFSx86
Run by Owner at 16:10:46.34 on Tue 03/31/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.186 [GMT -4:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
C:\WINNT\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINNT\system32\ezSP_Px.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINNT ... Read more

Answer:Not sure what I have...but it keeps coming back

Welcome to the BleepingComputer Forums. Since it has been a few days since you scanned your computer with HijackThis, we will need a new HijackThis log. If you have not already downloaded Random's System Information Tool (RSIT), please download Random's System Information Tool (RSIT) by random/random which includes a HijackThis log and save it to your desktop. If you have RSIT already on your computer, please run it again. Double click on RSIT.exe to run RSIT. Click Continue at the disclaimer screen. Please post the contents of log.txt. Thank you for your patience.Please see Preparation Guide for use before posting about your potential Malware problem. If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped. Please post your HijackThis log as a reply to this thread and not as an attachment. I am always leery of opening attachments so I always request that HijackThis logs are to be posted as a reply to the thread. I do not think that you are attaching anything scary but others may do so. While we are working on your HijackThis log, please: Reply to this thread; do not start another! Do not make any changes on your computer during the cleaning process or download/add programs on your computer unless instructed to do so. Do not run any other tool until ... Read more

2 more replies
Relevance 49.2%

Can't seem to get rid of the trusted zones, option is disabled in internet tools. I've run spybot, adware and avast but they still show.

Logfile of HijackThis v1.99.0
Scan saved at 10:18:03 AM, on 2/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmgr.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Lexmark X6100 Series\lxbfbmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.... Read more

Answer:they keep coming back!

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

Turn off system restore by right clicking on My Computer and go to Properties->System Restore and check the box for Turn off System Restore. Click Apply and then OK. Restart your computer. After we are finished with your log file and verified that it's clean, you may turn it back on and create a new restore point.

Right click on this link http://www.greyknight17.com/spy/De... Read more

3 more replies
Relevance 49.2%

I think I may have finally scrubbed enough to keep the dll (IeBHOs.dll) from re-appearing, but the E2G folder keeps recreating itself. Any suggestions?

It's a friends system and had Norton on it. I installed NOD32 and PC Tools Spyware Doctor. Then read a few threads and ran HJT a few times and made some deletions that "may" have helped. I know that I managed to get rid of the TrojanDownLoader-AC2 but this E2G is stubborn.

Also ran SpySweeper many times in safe mode and in non-safe mode. Disabled Spyware Doctor from auto load with windows as it seemed to be interefering with the Spy Sweeper scan.

Here's the latest HJT log:

Thanks in advance for any suggestions!

Charlie

Logfile of HijackThis v1.99.1
Scan saved at 6:51:15 PM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:E2G keeps coming back

Thread closed, please do not post duplicates!
Continue here: http://forums.techguy.org/security/460316-e2g-keeps-coming-back.html
 

1 more replies
Relevance 49.2%

Hey everyone this is the first time I have posted anything but i am having some serious problems. I let my brother borrow my laptop and when i got it back it was infected bad.
I have pc-cillin, Malwarebytes, and SuperAnti-Spyware.
SuperAnti-Spyware seems to clean everything after i scan and reboot but there are two things that keep coming back on the next re-boot.
1. Pc-cillin keeps giving me a waring telling me to close the browser when its not open with the web address of 110/rjsa/select.php?a=6707a0a cd82d9318fa98c6ee396eed8e61fcf4200553e0c95d8b1d81bbda3c1b&b=1001&c=1
2. There is a sys32 file that gets deleted and always comes back on reboot its MoIXWA40.dll
Pc-Cillin tells me this is a trojan.bho and says its will delete on reboot.
please help me this is so frustrating it slows everything down sooo slow.
 

Answer:Pop-Ups keep coming back

Hi, Welcome to TSG!!
Click here to download HJTInstall.exe

Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

 

1 more replies
Relevance 49.2%
Question: Keeps coming back

Ok guys not sure what I keep missing but the 020 line keeps coming back and changing it name.

I have ran CWS, ewido, Killbox ( and delete after reboot) VirtumundoBegone
Logfile of HijackThis v1.99.1
Scan saved at 11:25:30 AM, on 1/22/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Hijack This\TrojanHunter 4.2\THGuard.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDae... Read more

Answer:Keeps coming back

10 more replies
Relevance 49.2%

I uses Vundofix, ad-aware, spybot, xoft, avg, House call, Microtrend, Don't know what to do next? here is my infoLogfile of HijackThis v1.99.1Scan saved at 1:48:37 PM, on 3/22/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\NavNT\defwatch.exeC:\Program Files\NavNT\rtvscan.exeC:\Program Files\Norton Utilities\NPROTECT.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\svchost.exeC:\Program Files\NavNT\vptray.exeC:\Program Files\BearShare\BearShare.exeC:\Program Files\ArcSoft\PhotoImpression 5\PI Monitor.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.Begin2Search.com/search.htmlO4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\... Read more

Answer:Pop Up's Keep Coming Back

Hello Mhenry, Welcome to BleepingComputer!My name is Nick and I will be checking over your log.Let's get started.You will want to print or save these instructions.Please download Look2Me-Destroyer.exe to your desktop.Close all windows before continuing.Double-click Look2Me-Destroyer.exe to run it.Put a check next to Run this program as a task.You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 1 minute. Click OKWhen Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.Once it's done scanning, click the Remove L2M button.You will receive a Done Scanning message, click OK.When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.Your computer will then shutdown.Turn your computer back on.Please post the contents of Look2Me-Destroyer.txt (it can be found wherever you saved Look2Me-Destroyer.exe) and a new HiJackThis log.If Look2Me-Destroyer does not reopen automatically, reboot and try again.I highly suggest you get rid of BearShare. It is a P2P program which is usually the cause for malware.Read here for more information on clean and infected File Sharing Programs.Click Start> Control Panel > Add/Remove Programs and remove:BearSharePlease note any other programs that you dont recognize in that list in your next responseReboot your computer once more.Please go HERE to run Panda's ActiveScanOn... Read more

1 more replies
Relevance 49.2%

I am having trouble getting rid of this BHO object.Everytime I manage to remove the dll and the BHO registry entry it comes back under a different name.I have run Spybot, AdAware and Trend Micro AV.Any help would be appreciated.Logfile of HijackThis v1.99.1Scan saved at 3:17:14 PM, on 04/16/07Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exeC:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exeC:\WINDOWS\system32\fxssvc.exeC:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exeC:\WINDOWS\TEMP\EWE594.EXEC:\WINDOWS\Explorer.EXEC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files ... Read more

Answer:Bho Keeps Coming Back

Hello EBurritt, I am SifuMike and I will be helping you. Disable your antivirus program and go here http://www.bitdefender.com/scan8/ie.html and run an online scan with BitDefender (you will need to use Internet Explorer for this scan). When the ActiveX Control has loaded, click on "Click here to scan". Please be patient, as this scan may take a few hours. It all depends on the number of files on your computer. When BitDefender completes the scan, select the "Detected Problems" tab. Click on "Click here to export scan". Save the file as an HTML to your Desktop. Then click on the saved file and allow it to open with your browser. Go to Edit - Select All then copy/paste that log back here. Post the BitDefender log.******************Download ATF (Atribune Temp File) Cleaner? by Atribune DO NOT run it yet. Download and install AVG Anti-Spyware 7.5 (formerly Ewido) This is a 30 day trial of the programAVG Anti-Spyware is designed to be used to both scan for and remove malicious files and also to run in real-time alongside, but not replace, your existing anti-virus program to give an added layer of protection.Both the Resident Shield and Automatic Updates will only be available for the thirty day trial period, after that AVG Anti-Spyware will revert to a stand-alone scanner which you can keep and manually update for free and use in a similar way to Ad-Aware SE Personal, Spybot S&D etc.1. After download, double click on the file to launch the... Read more

11 more replies
Relevance 49.2%

I think I may have finally scrubbed enough to keep the dll (IeBHOs.dll) from re-appearing, but the E2G folder keeps recreating itself. Any suggestions?

It's a friends system and had Norton on it. I installed NOD32 and PC Tools Spyware Doctor. Then read a few threads and ran HJT a few times and made some deletions that "may" have helped. I know that I managed to get rid of the TrojanDownLoader-AC2 but this E2G is stubborn.

Also ran SpySweeper many times in safe mode and in non-safe mode. Disables Spyware Doctor from auto load with windows as it seemed to be interefering with the Spy Sweeper scan.

Here's the latest HJT log:

Thanks in advance for any suggestions!

Charlie

Logfile of HijackThis v1.99.1
Scan saved at 6:51:15 PM, on 4/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EX... Read more

Answer:E2G keeps coming back

16 more replies
Relevance 49.2%

I've run Ad-awareSE, Trend Micro's housecall, and McAfee. I've also run Ad-aware while in safemode yet I still keep getting these popups and McAfee keeps telling me that " The file C:\\WINDOWS\system32\winupdt.exe was infected by the Downloader-LG trojan and has been deleted to complete the cleaning process. Its' says it repeatedly then stops then a few hours later it'll come back. Here is my Hijack This log:
Logfile of HijackThis v1.99.1
Scan saved at 6:07:30 PM, on 3/15/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wkogyo.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Mixer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:... Read more

Answer:They just keep coming back...

16 more replies
Relevance 49.2%

hi, i hope somebody can help me. I'm running windows 95 b with internet explorer 5.5 and I keep getting "Error loading C:\WINDOWS\TEMP\se.dll". when I run IE, avg detects trojan horse startpage 16.bd and my start page is now advertising called "about: blank" I've deleted se.dll but it just keeps coming back. I'd appreciate any suggestions. thanx!
 

Answer:se.dll keeps coming back!

it sounds like you got hijacked. this should have been posted on the spyware specific board. follow the instructions on this link below.

http://forums.majorgeeks.com/showthread.php?t=35407 <--
Sticky: READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

g/l - sos
 

1 more replies
Relevance 49.2%

windows securty 7 keeps coming bak after doing all the steps
 

Answer:it keeps coming back

Please attach the logs from both SUPERantispyware and MalwareBytes. Also run the below and attach the log.

I want you to run TDSSKiller so refer to the below for how to do so.

TDSSkiller - How to run
 

11 more replies
Relevance 49.2%

I have a problem with pop-up ads that keep on appearing randomly on my computer. I tried using adaware which picked up a lot of them, but they keep coming back later.

Hijack this log (Created with Hijack-this Analyzer)

====================================================================
Log was analyzed using KRC HijackThis Analyzer - Updated on 4/1/05
Get updates at http://www.greyknight17.com/download.htm#programs

***Security Programs Detected***

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Fil... Read more

Answer:Pop-Ups that keep coming back

Hi and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem a.s.a.p

Please be patient with me during this time.

4 more replies
Relevance 49.2%
Question: keeps coming back

I keep running scans and it cleans the computer sometimes. I will encounter xp antispyware 2009 and 2008 telling me that my computer is infected. It posts a permanent box on my desktop saying infected and keeps popping up at bottom right by time clock saying infected. I will run anti malwarebytes and it will clean it only if i do quick scan. But then i will run full scan and it freezes so i know it is still infected. And sure enough a few days later it is all back. Please help. I also run cc cleaner and norton but norton freezes too. I have also tried in safemode but still freezes. Thanks Any and all help is greatly appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:56:21 PM, on 10/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Inte... Read more

Answer:keeps coming back

bump
 

2 more replies
Relevance 49.2%

Hot bar I am told is a parasite.That is its a freeby thats seems frindly but in reality is sucking all your secrets.So last night I deleted all trace of it from the system by norton and by Regedit.Tonight it back......What sort of mallet this this need ?

Answer:hot bar keeps a coming back

Please post a HJT log click hereYou may need to post in in two halves because of the 800 word limit.Please double space it by adding a blank line after each line so that it is legible with the site's formatting.

4 more replies
Relevance 49.2%

Hi everyone,

i had this fake FBI Virus on a laptop couple days ago, it would not let the windows to boot, not even in safe mode. i got it to clean with kaspersky boot disc, and also scanned it with avg, malwarebytes, avast. send it back to customer, same night he called me saying avast kept picking up something but was not able to remove it! so i picked it up again the next day, scanned with avg & malwarebytes seemed to be cleaned up again, nothing was picking up any viruses. but guess what? this morning i have a text from a custoemr, saying he was locked up out of screen and he was able to get into it, but now avg is picking up something again!!! i asked him if he uses usb drive or external or anything but he said he did not use any of those! PLEASE HELP WITH REMOVAL OF THIS!!!!

Answer:It keeps coming back!!!!

Hello sapikest,
my name is Marius and I will be assisting you with your Malware related problems.

Before we move on, please read the following points carefully.
First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Before we start, please note:

Please be advised that this free service is typically for home users. We'll help you out this time, but in the future if you are unable to clean a machine via standard methods, then either backup the client's data and rein... Read more

2 more replies
Relevance 49.2%

I have done everything to get rid of my recent popups including runings spybot, adaware, microsoft Antispyware, Norton and Pandascan both in regular mode and safe mode. THey keep on finding stuff, but after restarting, they still come back. I have also empties the TEMP folder and cookies and temporary Internet files. I have included a HIJACK this log, hopefully someone can help. thanks.

Logfile of HijackThis v1.99.1
Scan saved at 6:34:55 PM, on 6/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~3\GHOSTS~2.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\GWHotKey.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe... Read more

Answer:HJT Log because they keep coming back

16 more replies
Relevance 49.2%
Question: Keeps Coming Back

Can someone please help me with this problem? All my AV programs detect a virus running in my system, but whenver I have it removed, it keeps coming back How can I stop this???


HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:22:13 AM, on 8/25/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Nexon\Mabinogi\npkcmsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\csrcs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.... Read more

Answer:Keeps Coming Back

Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

---------------------------------------------------------------------------------------------

If you still require assistance with this issue, please do this:
Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool and click Continue at the disclaimer.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt here.
Please attach info.txt to your post.
To attach a file to a new post, simplyClick the[Manage Attachments] button under Additional Options > Attach Files on the post composition page, and
copy and paste the following into the "Upload File from your Computer" box:C:\rsit\info.txt

Click Upload.

---------------------------------------------------------------------------------------------

2 more replies
Relevance 49.2%

Oh God help me... these anti-spyware pop ups keeps popping up and i always run a check on ad-aware 6 and Spybot once i see it. But once i connect to the net and open a site, it all comes back again n i haf to scan it all over again.... help please this is real miserable...

Thank you.

Answer:It just keeps coming back...

try manually removing, on www.doxdesk.com there are listings for spyware/parasites.

you could also go to run > msconfig and deselect any programs starting up that you dont recoginse.

also try going to http://www.symantec.com/homecomputing/
at the bottom is a link to a free online virus check, you may have one that persistantly downloads spyware.

and finally ensure you have a firewall and if you have one make sure its up to date. www.download.com has a free copy of zonealarm, thats a good one

6 more replies
Relevance 49.2%

Here is my dilemna:

I've run Kazaabegone, CWShredder, Spybot and Adware with new updates and reboots in between. I've run Hijack This and removed what I knew to be suspicious files in safe mode. But one:

O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net

keeps reappearing on the HJT log after rebooting. I know I'm missing something; just don't know what.

Here is the entire log:

Logfile of HijackThis v1.97.7
Scan saved at 8:04:28 PM, on 2/1/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\Program Files\EarthLink 5.0\Con... Read more

Answer:New.net keeps coming back

6 more replies
Relevance 49.2%

I have a PC i believe is infected.
i have run Combofix, it appears to find something and reboot but i am unable to tell by the log what it found.
i think it is still infected because if i run CF again, it says it needs to reboot to continue.
 ComboFix.txt   29.88KB
  5 downloads
 ComboFix2.txt   30.15KB
  3 downloads
 ComboFix3.txt   26.11KB
  2 downloads
 ComboFix4.txt   29.75KB
  3 downloads

Answer:it keeps coming back

Hello cgtrott, I will be handling your log to help you get cleaned up. I apologize for the delay but the forum is very busy and as you can see the logs we ask for are very extensive and take a lot of time to investigate. Please subscribe to this topic. Click on the Watch Topic button, select Immediate Notification and click on proceed.Make sure Word Wrap in notepad is turned off. When copying and pasting logs paste them directly in the reply box only attach logs if asked to. Do not wrap logs in codebox or code tags. It makes it very difficult to read and analyze them. Please paste them directly into the reply box. Do not make any changes to your system until we are through. Fixes are based upon information that is current from your system so any changes can affect our strategy. Please refrain from running any tools we may use without specific instructions.If your operating system is Windows Vista or Windows 7 it may be necessary to right click then choose Run as Administrator any programs we use.Before we begin please check and follow the instructions on How to Show Hidden Files and Folders in Windows Vista and Windows XP and How to show hidden files in Windows 7Because the e-mail notification system is not completely reliable, please check your topic once a day for responses.Please read carefully all directions and instructions. If you are instructed to save a tool to the desktop please save it to the desktop. If you have since resolved the original problem you were ha... Read more

2 more replies
Relevance 49.2%

I am trying to clean out a co-worker's computer. I have restored to over a month ago and continue to find malware during scans. Any help appreciaded. Have not yet restarted to fully remove. Do I need to kill some files will killbox prior to the restart? Thanks, Jeff

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Database version: 3930

Windows 6.0.6001 Service Pack 1
Internet Explorer 7.0.6001.18000

3/31/2010 2:19:22 PM
mbam-log-2010-03-31 (14-19-22).txt

Scan type: Full scan (C:\|)
Objects scanned: 231065
Time elapsed: 1 hour(s), 11 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Windows\System32\config\systemprofile\AppData\Roaming\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.

Files Infected:
C:\$Recycle.Bin\S-1-5-21-2658977195-169558386-357108580-1000\$RR7NTAN.tmp (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\avp.ico (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Wi... Read more

Answer:ave.exe keeps coming back

Windows restarted for updates while sleeping last night. Running malwarebytes again. Final rid of Hijackthis entries
O20 - AppInit_DLLs: C:\ProgramData\nuvanifi\nuvanifi.dll
2658977195-169558386-357108580-1000

Malwarebytes came out clean as well as a full McAfee virus scan. Hijackthis log appears clean too. With persistance I think I have this cleaned finally. I have both a dds scan and gmer report but don't really know what to look for. I can post these if someone has time to review them. I ran both prior to the windows update restart. Also updated and ran spywareblaster. Pop ups and redirects are gone too.

Partial log of items cleaned.
3/31/2010 2:19:22 PM
mbam-log-2010-03-31 (14-19-22).txt

Folders Infected:
C:\Windows\System32\config\systemprofile\AppData\Roaming\AntiVirus Plus (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.

Files Infected:
C:\$Recycle.Bin\S-1-5-21-2658977195-169558386-357108580-1000\$RR7NTAN.tmp (Trojan.Agent.Gen) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\avp.ico (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AntiVirus Plus.lnk (Rogue.AntiVirusPlus) -> Quarantined and deleted successfully.
C:\Windows\System32\config\systemprofile\Local Settings\Application Data\ave.exe (Rogue.MultipleAV) -> Quarantined and deleted successfully.
C:\Windows\System32\co... Read more

1 more replies
Relevance 49.2%

okay, so yesterday i cleaned my pc with "malwarebytes anti-malware and there were like 11 viruses. then i scanned after t, none, so i get up this morning and scan my pc because everything is going SO SLOW! and now i got 10 viruses. can anyone please help? yesterday i had like 2 injections, 2 clickers, 2 malware.packs, and like 6 agents.
heres my log for yesterday: http://pastebin.com/panEZfVS
and heres todays: http://rhymingcolors.pastebin.com/G7gJ51nr
please help. 5 of those kinds ive never seen before :/ please comment below
 

Answer:they keep coming back >:(

8 more replies
Relevance 49.2%

I can't get rid of this crap - I've ran everything on here that people say. I have SAV installed and up to date, I have SpywareGuard installed, I have ran HJT, I've ran Ewido software, nothing can get rid of this - Everytime I clean everything while in Safe mode and reboot, Spywareguard immediately starts popups saying a BHO has been added (suchs as C:\WINDOWS\system32\wvuvspq.dll) - I click remove BHO, and it comes back over and over...

Someone please help - this has totally destroyed my computer...
 

Answer:Someone please help - These BHO's keep coming back!!

Closing duplicate thread. Please continue to reply here: http://forums.techguy.org/malware-removal-hijackthis-logs/648572-please-help-my-hijackthis-log.html
 

1 more replies
Relevance 48.79%

So, sometimes when my Win 8.1 machine comes out of sleep mode, it seems to lose focus. What I mean by that is some items in the notification area disappear and that item no longer works.

Example: Windows just came out of sleep mode and now my Outlook icon has disappeared in the notification area and Outlook is no longer functioning. Same happens with other items in the notification area like Catalyst Control Panel, SoundBlaster soundcard control panel, and a few other items. They just disappear from the notification area and cease to function. The only way to get them back and functioning again is to restart the PC.

This only happens when the PC comes out of sleep mode, though it is random.

Any ideas?

BTW you can view my system specs for questions concerning it.

Thanks.

More replies
Relevance 48.79%

When I click "play" on World of Warcraft, I get a error message that says

WoW.exe - Bad Image

The application or DLL C:\WINDOWS\system32\OPEN32.dll is not a valid Windows image. Please check this against your installation diskette.

I tryed to reinstall WoW, and that didnt help. I also ran several virus scans and those did not help.

I later found that when I click "system information" in "my computer", I get the same error message (it just dosint say WoW.exe of course).

I dont know if this is related or not, but another problem I have is that when I click User Accounts, I get a completly white screen with nothing on it, and nothing ever loads. If this is unrelated then I dont mind ignoreing it.

I run windows XP, and if there is any other specs i sould post then let me know.
 

Answer:strange error message coming up when I try to play WoW

Put in your XP CD, close the window if it autoloads. Then, Start > Run > sfc /scannow

to check for valid system files.
 

1 more replies
Relevance 48.79%

Hello

I have strange clicking or cracking sound intermittently. It look like a static interference noise (but it is not a static interference) This is worst when I'm listening to a video on Youtube.
Clicking or static could be hear, even when the video as stopped. Look like the system can't keep up

I played with the sound mixer. I got many applications running at the same time that sent me sound indicators

The clicking sound is lowered when I lowered the sound on the : "Sound System", leaving the others on the max level. When clicking or static do occurs, I could clearly see on the System Sound level bar, the increase or the movement that occured in the "System Sound" application

This is clearly an electronic or drivers problem, not a speaker or physical one

Hope I'm clear enough on my approximative English

Any help appreciated

Answer:Strange clicking noise coming out of speaker

Hi.
Cracking sounds you described could be generated by signal interference, oscillating electronic circuit, or even any loose end of connectors/plugs.
Since you're sure it isn't about your sound system, I try to help you making some guess.
Make sure there is no inducting device too near to your machine (fan, motorized device)
Observe your sound input cable and both side connectors/plug, are they all intact, and well fitted.
If you plugged it in on front audio panel, unplug it, and try to plug it in on rear audio panel
No more guess can be made here, but hope it could give you something.

Kevin

6 more replies
Relevance 48.79%

                        I am trying to get my instructions checked but there are so many obsticles that appear.
                             Different ones from hour to hour..To be honest i felt like giving up as i suffer from
                            psoriasis and it's bad..Now my pc is cutting out like it's overloading, or overheating..
                             Can anyone tell me about this address..I have Google browser but cant be sure
                                                           if it's the real browser..I doubt it is,..
 
"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36,gzip(gfe),gzip(gfe)"
 
                             I am on with the preperation for wiping all the nasties from my pc with your instructions            
 
                                      &... Read more

Answer:Strange Address coming when i check my IP from Gmail

Sorry to cause problems here..I am having problems backing up my files..I followed all the instructions...
 
This was what i got in the back up with my back up
 
2015-04-08 15:27 The log tab has been cleared. The log file with its full content is still available from the Log menu
    2015-04-08 15:27 *** A new backup has started. Number of tasks in queue: 1 ***
    2015-04-08 15:27 Preventing the system from entering sleep mode...
    2015-04-08 15:27 ** Backing up the task "New task" **
    2015-04-08 15:27 Counting the files for the task "New task"...
    2015-04-08 15:27 Starting the Volume Shadow Copy snapshot for the drives: C:\
ERR 2015-04-08 15:27 Couldn't contact the Volume Shadow Copy requester. Please check that the service is installed and running
    2015-04-08 15:27 Warning: The .NET 3.5 framework doesn't seem to be installed on your computer. This platform is needed to execute the Volume Shadow Copy requester 
    2015-04-08 15:27 Changing the backup type to full. Reason: task's first backup
    2015-04-08 15:27 Creating the destination directory "USB DISK\"
ERR 2015-04-08 15:27 Couldn't create the destination directory "USB DISK\": The filename, directory name, or volume label syntax is incorrect
    2015-04-08 15:27 Creating the destination directory "USB DISK\"
ERR 2015-04-08 15:27 Couldn't create the destination directory "USB DISK\": The filename, direct... Read more

2 more replies
Relevance 48.79%

Evidence:

Spoiler


 
Oh and hello, I am new to this forum.
 
 
Here is my issue:
 
There is this strange sound playing randomly. I have no idea what it is and I have done everything to try to get rid of it.
 
I tried:
*Checking system sounds
*Malware bytes
*TDSSKiller (to be sure it's not a rootkit)
*A bunch of different varieties.
 
 
Can someone tell me what this sound is and if possible, tell me how to fix it or what it is coming from?

Answer:I have little to no idea what this strange sound is coming from + Evidence

Please download TDSSKiller from here and save it to your DesktopDoubleclick on TDSSKiller.exe to run the application, then click on Change parameters


Check Loaded Modules  and Detect TDLFS file system.  Do not check Verify file digital signatures (even though it is checked in the example)If you are asked to reboot because an "Extended Monitoring Driver is required" please click Reboot now


Click Start Scan and allow the scan process to run

If threats are detected select Skip for all of them unless I instruct you otherwiseClick Continue


Click Reboot computerPlease post the contents of  TDSSKiller.[Version]_[Date]_[Time]_log.txt found in your root directory (typically c:\)in your reply===================================================aswMBR--------------------Download aswMBR and save it to your desktop.
Please disable your real time protection of any Antivirus, Antispyware or Antimalware programs temporarily. They will interfere and may cause unexpected results.If you need help to disable your protection programs see here and here.Double click the aswMBR.exe file to run it. Please allow when you are asked to download AVAST antivirus engine defs.Wait until the AV update is done, then click on the Scan button to start. The program will launch a scan.

When done, you will see Scan finished successfully. Please click on Save log and save the file to your desktop.

Please post the contents of the log in your next reply.NOTE:  aswMBR will create M... Read more

21 more replies
Relevance 48.79%

I recently own a Tecra 9000, it was running swell until it started to give off ticking sounds. I am 100% sure that it isn't coming from the speakers. The sound appears to be coming somewhere around the hardrive it self and after the ticking sound the system goes to a blue screen like the one you see when it crashes.

Answer:Strange sound coming from Tecra 9000

Please some more informations. Did you check the function of CPU fan, does it work? (blowing noise)Did you take off the HDD and run it from a bootable disc/CD only?

3 more replies
Relevance 48.79%

Hello everyone!Computer descriptionModel: VECTRA VL 420 MTPROD : P6200W#ABAOS: Windows XPThis computer stopped working, when plug the power cable the front panel light comes on without me hitting the power button.After that there is a short display on the screen as if it is starting then it disappears, the PC makes a very strange sound for sometime, when that strange sound is gone, and then it beeps two times.I tried changing power supply but the problem continues, I unplugged all devices except for the CPU and power supply, I turned it on the same noise persists, it starts with a very strange long noise, when that noise is over it beeps two times. I tried removing the BIOS Battery, still no success.Can someone please help?[attachment deleted by admin]

Answer:Hardware failure with strange sound coming from the PC

I forgot to mention, i have attached a Zipped MP3 file, please open it and listen to the strange sound, perhaps that can give a clue of whats i'm trying to say and Shaw as what is wrong. Any help is welcomed

14 more replies
Relevance 48.79%

Hi Since this evening a weird sounds has been coming out of the right speaker/earphone of my laptop. It is a weird beeping/cherping sound which will make which makes about 5 short bursts in less than a second, then about 4 seconds before doing it again. There is also a strage creeking/glitchy sound which seems to be louder, more noticeable when the computer is working. When idle is sounds kind of like a heard beat with a random elecrical creak
I know the description is strange but this this the only way i can describe it.

There is no other electrical equipment around me which could be causing intefeance. Also I tried moving around the house it was the same everywhere.
And again, it only comes though the right speaker (earphone if i have them plugged in!)

I have also tried resarting my computer and trying a differnet user account.

My computer is a Acer Aspire 5670 (laptop) About 3 and a half years old. Running Windows XP Service pack 2

Thanks for anyhelp =]
 

Answer:Strange sound coming from right speaker/earphone

Hi everyone I played around with RealTek HD audio manager on my laptop and managed to get rid of the weird sound and make my laptop output sound lounder. The settings must of been set wrong or somehow changed accidently
 

2 more replies
Relevance 48.79%

So, today while I was playing World of Warcraft, my computer started making strange noises at me. At first I thought I had left an internet tab open or something because I kept hearing commercials and pop news highlights coming through my speakers. But after making sure that everything was shut off, the noises kept coming. Upon further inspection through my volume mixer I found this strange program producing noise but it had a "No Name Available" as a descriptor.

I have run Malwarebytes Pro and Combo and uninstalled everything that I had run today but it still persists. I even did a full system restore dating back a couple weeks yet the noises keep coming. PLEASE HELP! I have no idea what's causing this and it is literally driving me batty. Any ideas?

Desperate for answers,

ArcadianPhoenix

Answer:Strange sounds Coming from Mysterious program

So, today while I was playing World of Warcraft, my computer started making strange noises at me. At first I thought I had left an internet tab open or something because I kept hearing commercials and pop news highlights coming through my speakers. But after making sure that everything was shut off, the noises kept coming. Upon further inspection through my volume mixer I found this strange program producing noise but it had a "No Name Available" as a descriptor.I have run Malwarebytes Pro and Combo and uninstalled everything that I had run today but it still persists. I even did a full system restore dating back a couple weeks yet the noises keep coming. PLEASE HELP! I have no idea what's causing this and it is literally driving me batty. Any ideas?Desperate for answers,ArcadianPhoenix'Strange sound' is not very indicative of the type of sound you're hearing. Could you be a little more precise? Is it for example, a buzzing noise, a high pitched whine or what?

8 more replies
Relevance 48.79%

Hi.

My brother has a Toshiba Satellite Pro A60 - my old laptop. However it has a strange sound issue. I wiped it a few months back, and the sound worked fine. However after a week or so it suddenly started sounding like the speakers were blown.

I made the assumption that the speakers were indeed blown and plugged in external speakers - however they made the same noise! I was wondering, does this sound like a fried sound card, or a drivers/software error?

If it is a sound card error, can the sound card be changed?

Answer:Satellite Pro A60: strange sound coming from speakers

Hi,

no the sound card couldn?t be changed, it?s on the mainboard and if you want to exchange it, you must exchange the whole mainboard.

First question: do you have still warranty on that machine?

Then my suggestion:

Backup all data on the machine, recover it with the recovery CD and then the noise should be gone. If not, and if you got still warranty on that machine, then it would be better to bring the machine to an service partner for an hardware checkup.

Give some feedback if you got some further questions.

Greets

1 more replies
Relevance 48.79%

Hi.

I have a problem:
Yesterday when I was playing a game on my PC a strange sound started coming form my graphics card. I have never experienced this before.
I have an ATI Radeon HD 5870.

At first I thought it was one of the fans, so I removed the graphics card and cleaned the cooler and the fans as much as possible. I also cleaned the side fan of my chassi. The sound is still there.
I tried controlling the graphics cards fans manually and setting them to 100%. I could hear the fans speed up, but the annoying sound was gone.

Whenever I start a game, movie or other thing that makes my graphics card work the sound returns.
I filmed a video using my cell phone to illustrate the sound:

Strange sound - YouTube

Does anyone know what the sound is? Is it possible to fix it?
Can I be certain that the sound is coming from my graphics card?

Thanks in advance.

Answer:Strange sound coming from graphics card

other suspects could be the CPU cooler.

try using a finger (or a pen) to momentarily stop (a second or so, not much more) the graphic card fan, then cpu fan and then chassis fan when you hear this noise. if it stops when the fan is stopped, then you found the device responsible of the noise.

fans do similar annoying sounds when getting older.

1 more replies
Relevance 48.79%

Hello. I am using a Dell Latitude 1150. It has an ESS Maestro PCI soundcard. Whenever I use the laptop, there is a strange electric/electronic noise... it intensifies when I move hte cursor, and when the comptuer is loading. It is not white noise. It is not a ground loop. It is very strange. When I hooked an RCA cable from the "Tape Out" of my mackie mixer, into the input of the laptop; the recording was ruined, because of this noise. I will try and post an audio sample of this noise eventually. But... it is definitely digital. It is somewhat pitched; and reminds me of the sound cheap portable CD players make through headphones when switching between tracks.

Anyways, my question is, is this hardware or software related? ESS has not released any driver updates for WinXP besides what was on the WinXP installation CD. I have 5 other identical laptops, and they all have this problem.

Any help much appreciated,

AlexTs
 

Answer:Strange electrical noise coming from soundcard

8 more replies
Relevance 48.79%

http://files.bighosting.net/yq4496.mp3

That is a 32 second mp3 (328kb - sorta faint, turn volume up) of a noise I have been hearing on my radios, phone & computer for over a year now. Different radios, different phones, different computers... and different locations! I first started hearing it at my house, before the divorce. Not all the time, it was an occasion thing. Thought I was losing it.

But then my son heard it, and my ex-wife. I could never get a recording of it because it was completely random; you never knew when it would happen. You might hear it three times in a day, then not hear it again for weeks.

I hadn't heard it since I moved into this apartment four months ago (so I figured it was related to the house itself, a wiring thing or something, I dunno), until today... and today it has been going non-stop! WTF is it?? It's makin' me nuts. I think I'll send it in to Art Bell
 

Answer:Strange noise coming through computer speakers

Link's broke... try this one
http://home.comcast.net/~fahfooh/noise.mp3
 

4 more replies
Relevance 48.79%

I have my Toshiba laptop A200-23 model PSAE6E for 1.5 years and I recently got it back from service.
I've sent it there because of a non functional key.

Everything is fine, they've changed the keyboard... but ever since I've got it back I have noticed some strange noise coming from to fan area...

The sound is not so loud but it's quite annoying.
I have cleaned it using compressed air, but the sound did not dissapear.
It is still under warranty but I don't think that they would do something against this noise.

The laptop is working fine, it isn't overheating or something but I can't get used to this sound.
Whatd should I do?

Answer:SatelliteA200-23k - strange noise coming from to fan area

Hi

Difficult to say what noise could it be?
But if the notebook was disassembled by an ASP technician in the past, then you should get in contact with the same technicians again and should explain your situation!
Maybe a screw has been forgotten? who knows?
I think the technician should take a look on this notebook again?

I would not recommend opening and disassembling the notebook yourself because you could cancel the warranty?

2 more replies
Relevance 48.79%

Every once and a while I here a strange series of clicking sounds coming from my pc tower. I built this pc and can’t think of what it could be. It sounds like someone’s turning on and off a light switch over and over. There are no symptoms in the software environment. Some times a series and sometimes a single “click” like someone turning on a light switch once. What do think it could be?
 

Answer:strange clicking sound (coming from tower)

Might be the click of death - hard drive failure. You're going to need to take the side off the case and wait for it to happen again. I guess it could also be a bad fan or something brushing against a fan as well - lets hope. While you wait you should back up the contents of the hard drive or at least the important things so if it dies you aren't completley unprepared.

Oh, and you can also download the hard drive manufacturer's diagnostics and test the drive - if the drive is click or periodically it may not fail the tests but its worth a shot.
 

1 more replies
Relevance 48.79%

I've noticed quite a few peopel are having trouble with this, so I wetn through another post and did everything recommended in tat post but I am still not having any luck.I did what was offered in this post:http://www.bleepingcomputer.com/forums/ind...4&hl=googleI have now ran super antispyware, avast antivirus, ran atfcleaner, otscanit, GMer, ComboFix, and HijackThis ... and i still have the same issues.I have attached the HIjack this log, as well as the otscanit, GMer, and comboFix

Answer:Google search coming up with strange links

gmer file

5 more replies
Relevance 48.79%

Hi there, I've recently built a new comp for audio work and everything is finally working except my now I can hear a strange garbled audio noise through my speakers once booted into windows. There is a constant ticking or whirring noise and when I move the mouse a I get a sound similar to a dial up modem noise. Halfway between a screech and a scrape.

Things I have tried:
Isolating the mobo and all the components from the case placing the mobo on an anti static bag and then a card box.

Updating Bios, soundcard drivers and graphics card drivers.

I've also tried using the onboard sound and this produces the same results.

I've also tested the soundcard, video card, PSU, and HDD in my old computer and booting from the same HDD produces no unwanted noises what so ever, the only things I can't test are the CPU, RAM and obviously the mobo itself.
I'm going a bit insane over this after about 8 phone calls to the retailer and numerous emails to gigabayte who don't seem to understand the problem.

I have no way of testing the CPU but I can't see it being the cause of the problem

Anyone's thoughts on this would be more than welcome. I even considered asking PC world (the only computer shop near me) for help, that's how desperate I'm getting.

Here's the spec:

Gigabyte EX58-UD5 Mobo
Intel i7 920
Noctua CPU cooler
12 OCZ Ram 1600MHz
ATI Radeon 4670 Graphics card (passive)
EMU 1820 Soundcard + Breakout Box
Be Quiet Dark Power P... Read more

Answer:Strange noises coming through speakers on new build

Suggest you begin unplugging cables and power sockets to see if you can make it stop... that may be a strange way of trouble shooting... But you may have audio feedback from a defective device... and first you have to find the device.
I assume you have carefully checked each and every cable and connection... an assured that everything is fully plugged in...
I would suspect the Sony optical drive, as we have seen noise emissions linked to that unit.

Try to get down to power supply, hard drive, one memory module, audio socket, and speakers... And also test the speakers on a friend's computer.
There are a great number of devices that, when defective, will cause this... so a systemized approach, with notes, may be helpful.
This happens to broadcast engineers all the time... and it is usually a mistake they have made with one cable or connection or another.
 

10 more replies
Relevance 48.79%

Hi all I own a Gainward 6800GT and yesterday it started making funny 'tick tick tick sounds' somehitng u would hear from a geiger counter when theres radiation (well according to what i heard in games and movies anyway lol) and i was wondering if anyone knows whats wrong with it?

thank you

Answer:Strange sounds coming from graphics card

Does your VGA Card has a Fan it could be the fan hitting itself when it spins the heat can cause that. it happened to me once.

8 more replies
Relevance 48.79%

So for the past couple of weeks my computer has been having some issues with these red lines coming across the screen I've attempted everything (except change the graphics card and hard drive) I have asked a few people who know computers and they never saw this sort of thing. It comes up with red lines then restarts but now with the red lines all over the screen. I'm running a GeForce 760 some one please help

Answer:Strange Red Lines coming across computer screen

This is what I'm seeing from my computer
click here

3 more replies
Relevance 48.79%

I've been getting the Win 7 Antivirus problem every few days lately. I can run a scan with mbam and kill it, but it keeps returning.Any advice?Heres a hijackthis log:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:48:46 PM, on 1/2/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v8.00 (8.00.7601.17514)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe
C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe
C:\Program Files\VMware\VMware View\Client\bin\wsnm.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files (x86)\Notepad++\notepad++.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\... Read more

Answer:Win 7 Antivirus keeps coming back

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/435844 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

2 more replies
Relevance 48.79%

My computer slows down as I open VLC player then when i look at the task manager, COM surrogate ates a lot of my computer's memory. I kept deleting all the com surrogate but it comes back on days that i open VLC player or any video/music player. The virus doesn't show when i don't open any player.
I've attached here the reports from farbar.
Anyone can help me on this. Thank you!
 

Answer:COM Surrogate keeps coming back

Hello,

They call me TwinHeadedEagle around here, and I'll be working with you.

Before we start please read and note the following:

At the top of your post, please click on the "Watch thread" button and make sure to check Watch this thread...and receive email notifications. This will send an email to you as soon as I reply to your topic, allowing me to solve your problem faster.
Please do not install any new software during the cleaning process other than the tools I provide for you. This can hinder the cleaning process. Please do not perform System Restore or any other restore.
Instructions I give to you are very simple and made for complete beginner to follow. That's why you need to read through my instructions carefully and completely before executing them.
Please do not run any tools other than the ones I ask you to, when I ask you to. Some of these tools can be very dangerous if used improperly. Also, if you use a tool that I have not requested you use, it can cause false positives, thereby delaying the complete cleaning of your machine.

All tools we use here are completely clean and do not contain any malware. If your antivirus detects them as malicious, please disable your antivirus and then continue.
If during the process you run across anything that is not in my instructions, please stop and ask. If any tool is running too much time (few hours), please stop and inform me.
I visit forum several times at day, making sure to respond to everyon... Read more

3 more replies
Relevance 48.79%

Hi all,I have been suffering from a problem which is driving me crazy. For a while now, Symantic alerts me that it found a Trojan Horse and a virus W32.IRCBOT. It Quarantines them but never delete them. I usually go and delete them manually. Once I restart my computer the viruses come back again.I have tried online scanner (F-secure) it found several viruses and renamed them without deleting them. This did not solve the problem. I also ran it in safe mode, but still Symantic always finds it again.I noticed that when am not connected to the internet, through a wire or any way, symantic does not prompt me about the viruses after I delete them fro quarantine.Below is my Hijackthis logg.----------------------Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:32:45 AM, on 1/3/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.5730.0013)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exeC:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exeC:\Program Files\... Read more

Answer:Trojan Keeps coming back

Problem solved using Malewarebytes anti-malware.

2 more replies
Relevance 48.79%

HJT for Check up
Ran adaware, ms antispyware beta, can't get to housecall or install wincritical updates.
I have a cd with sp2 which I will try to update.

Logfile of HijackThis v1.99.1
Scan saved at 12:11:35 AM, on 9/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:... Read more

Answer:Web Hijacker keeps coming back

Hi ucurl

Has this system been rebooted since you posted this Hijack log?

If so, please post a new log.
 

1 more replies
Relevance 48.79%

I've been getting nonstop ads/pop-ups for almost a month now, I ran spybot and it picked up things like Advertising.com Avenue A, Inc. and some others, It fixed the problem temporarily but everytime I start my computer and run spybot the problems come right back up again.Here's my HJT log:Logfile of HijackThis v1.99.1Scan saved at 2:56:02 PM, on 6/3/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Norton Internet Security\ISSVC.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Musicmatch\Musicmat... Read more

Answer:Spy/adware keeps coming back.

Hello Travis_C and welcome to the BC forums. After reviewing your log I see no signs of viruses or malware at this time. The log is clean.

I do see that you have Limewire installed. This applicaiton is known to have malicious programs included in its installation. I would recommend removing the program and deleting the folder. That should take care of any trojan issues you are having.

Cheers.

OT

3 more replies
Relevance 48.79%

I cannot get rid of a pop up that has this address:

http://ad.oinadserver.com/rw?iframe...AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGzT.SdsGZc8=,

How can I rid my computer of this menace? It is destroying my ability to do things without disturbance.
 

Answer:Persistent pop-ups that keep on coming back

Run HijackThis and click Do a system scan and save a log file
Your HijackThis log will open in Notepad. Post the contents of the log here

 

1 more replies
Relevance 48.79%

A week ago I got the Win 7 Antispyware virus. I ran a system restore to 3 days earlier, and for a while the computer ran normally. Then, 3 nights ago, the virus came back. Now, even if I do a system restore, the virus comes back in a day (interestingly always around 1-2 AM). It usually begins with a window popping up saying Adobe needs to update, even if I try to exit out of the screen, it just pops up again. Then right after the Win 7 virus activates.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_26
Run by avkuznet at 14:52:30 on 2011-12-17
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.8182.5222 [GMT -5:00]
.
AV: Trend Micro OfficeScan Antivirus *Enabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}
SP: Trend Micro OfficeScan Anti-spyware *Enabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program File... Read more

Answer:Win 7 AntiSpyware Keeps coming back.

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/433026 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

2 more replies
Relevance 48.79%

Hello and Welcome to the forums! My name is Gringo and I'll be glad to help you with your computer problems. Somethings to remember while we are working together.Do not run any other tool untill instructed to do so!please Do not Attach logs or put in code boxes.Tell me about any problems that have occurred during the fix.Tell me of any other symptoms you may be having as these can help also.Do not run anything while running a fix.Do not run any other tool untill instructed to do so!Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive. Plug the flashdrive into the infected PC. Enter System Recovery Options. To enter System Recovery Options from the Advanced Boot Options: Restart the computer. As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears. Use the arrow keys to select the Repair your computer menu item. Select US as the keyboard language settings, and then click Next. Select the operating system you want to repair, and then click Next. Select your user account an click Next. To enter System Recovery Options by using Windows installation disc: Insert the ... Read more

Answer:consrv.dll keeps coming back

The forum said that the post was too long when I tried to paste it in, so I just attached the log file.

14 more replies
Relevance 48.79%

I ran Pest patrol & it found WinPup32. I delete it & it doesn't show up on the next scan, but as soon as I reboot it reappears. It shows up in HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\pup. I ran hijack this & here's what the log says. Can anyone help me figure out how to get rid of this thing for good? How does it keep appearing after its been deleted? thanks in advance.

Logfile of HijackThis v1.97.7
Scan saved at 4:50:58 PM, on 5/7/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\DMI\BIN\WIN32SL.EXE
C:\WINDOWS\PSSVC.EXE
C:\WINDOWS\SYSTEM\3COM_DMI\3CDMINIC.EXE
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\TUN\COMMON\ESLCBCST.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\DMI\BIN\DELLDMI.EXE
C:\PROGRAM FILES\MS HARDWARE\POINT32.EXE
C:\PROGRAM FILES\NORTON\ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\NORTON\ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\SYSTEM\MSWHEEL.EXE
C:\WINDOWS\SYSTEM\PIKMCTRL.EXE
C:\PROGRAM FILES\PESTPATROL\PPCONTROL.EXE
C:\DMI\BIN\MONITOR.EXE
C:\PROGRAM FILES\PESTPATROL\PPMEMCHECK.EXE
C:\PROGRAM FILES\PESTPATROL\COOKIEPATROL.EXE
C:\DMI\BIN\NIC.EXE
C:\DMI\BIN\COO.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SEIKO\SLPCAP.EXE
C:\DMI\BIN\DNAR.EXE
C:\DMI\BI... Read more

Answer:WinPup32 just keeps coming back

7 more replies
Relevance 48.79%

Hello,

I believe I have a variation of the Zero Access Rootkit. It creates a file consrv.dll in the system32 directory. Hitmanpro has detected it and has tried to remove it, but it keeps reappearing.
Other symptoms have included the loss of internet connection (removing McAfee has resolved that issue). The windows firewall and service is completely missing and I have not been able to restore it. If left alone the system becomes unstable and I am forced to do a restore just to get it to boot.
I am running Windows 7 Home Prem 64 bit.
I have run the following without success Superantispyware, Malwarebytes, Spybot, rootkitbuster, Sophos, TDSSKiller, Kaspersky Rescue disk and a few others. All without success

I have attached the log files from DDS adn GMER. Although on GMER it would not let me check off most items (boxes were greyed out, I suspect it was because of the 64 bit OS).

I'm running out of ideas.... help...

Thanks,

Larry

Answer:Another zero access.... just keeps coming back...

Hi Larry! My secret agent name on the forums is SweetTech (you can call me Agent ST for short), it's a pleasure to meet you. I would be glad to take a look at your log and help you with solving any malware problems.If you have since resolved the issues you were originally experiencing, or have received help elsewhere, please inform me so that this topic can be closed. If you have not, please adhere to the guidelines below and then follow instructions as outlined further below:Logs from malware removal programs (OTL is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post. Please remember, I am a volunteer, and I do have a life outside of these forums.
Please make sure to carefully read any instruction that I give you. Attention to detail is important! Since I cannot see or directly interact with your computer I am dependent on you to "be my eyes" and provide as much information as you can regarding the current state of your computer.
If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
In Windows Vista and Windows 7, all tools need to be started by right clicking and selecting Run as Administrator!
If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
... Read more

7 more replies
Relevance 48.79%

Hi,
I cannot seem to completely clean this IE hijacker from my system.
I have Windows XP and I am running HijackThis 1.98.2 to scan and fix.

I delete entries such as:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\Profiles\sid\LOCALS~1\Temp\sp.html
I get on the web again afterwards, and this spyware is back.

Does anyone know to fix this completely?
Thanks
Sid
 

Answer:oz.msie.tv keeps coming back

16 more replies
Relevance 48.79%

Windows Malware Removal keeps removing two trojans everytime i start up.
They are Win/32/Tibs.IU and WinNT/Alureon.c

Also, when searching for stuff on google a lot of time links wil take me to pop-ups instead of the actual site.

I have attached my Hijackthis.
 

Answer:Tojans keep coming back

Welcome to Major Geeks!


Please follow the instructions in the READ & RUN ME FIRST link given futher down and attach the requested logs when you finish these instructions.
If you have problems where no tools seem to run, please try following the steps given in the below and then continue on no matter what you find. You only need to try the TDSSserv steps if having problems getting scans in the Read & Run Me First.

TDSSserv Non-Plug & Play Driver Disable

If something does not run, write down the info to explain to us later but keep on going.
Do not assume that because one step does not work that they all will not.
READ & RUN ME FIRST. Malware Removal Guide


Helpful Notes:

If you run into problems trying to run the READ & RUN ME or any of the scans in normal boot mode. You can run steps in safe boot mode but make sure you tell us what you did later when you post logs. See the below if you do not know how to boot in safe mode:
Starting your computer in Safe mode

If you have problems downloading on the problem PC, download the tools and the manual updates for SUPERAntiSpyware, Malwarebytes and Spybot ( links are given in the READ & RUN ME) onto another PC and then burn to a CD. Then copy them to the problem PC. You will have to skip getting updates if (and only if) your internet connection does not work. Yes you could use a flash drive too but flash drives are writeable and infections can spread to them.
To avoid addtional delay in gettin... Read more

1 more replies
Relevance 48.79%

Hopefully I've included enough information and made this topic correctly...
 
Basically I had an issue where my microphone would mute itself, figured it was a virus, and ran malwarebytes. It found stuff, removed it, and everything worked fine... for about a few hours. A few hours later the same thing occurred, ran malwarebytes again and found the same thing: "dnsl64.exe" detected, along with other things that it appears to be downloading. No matter how many times I remove it it seems to come back, and googling dnsl64.exe popped up no results that I could find and then each scan (after a few hours) pops up a bunch of junk, even if I leave the computer idle. It also downloaded something that appeared to change my browser homepage to "search.snapdo.c*m" if that helps diagnose anything.
 
I've attached the MWB and FRST logs, hopefully they help diagnose what the problem is! Thank you in advance for any help, would really appreciate getting rid of this nasty thing.

More replies
Relevance 48.79%

hi, I have win 2000. I have spyware that keeps coming back after booting. It's called IGetNet. Spybot and BPS spyware find it, but after I reboot, it's there again. I've looked in add remove and startup manager, but nothing there. Thankyou for any help you can give me.
 

Answer:spyware keeps coming back

14 more replies
Relevance 48.79%

I have something called clspring. Everrytime I run a virus scan it comes up. Furthermore it keeps reinstalling itself. It appears to connect to something called www.outerinfo.com. Popups usualy say http://c5.zedo.com. It has all but stopped my computer. How do i get rid of it for good? HiJack this log below.

Edit by chaslang: Inline log removed
 

Answer:clspring keeps coming back

Welcome to Majorgeeks!

Please do not post any logs inline with messages!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
Make sure you check version numbers and get all updates.
Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:
Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
Bitdefender
Panda Scan
HijackThis

.
 

5 more replies
Relevance 48.79%

Hello!Someone on the CNET malware forum suggested that I post an HJT log here, because I have an enduring problem and need some help.This weekend, my computer was considerably slowed down. My browser had been hijacked and was redirecting me to suspicious websites. My windows firewall was deactivated without my consent and I couldn't update my antivirus (AVAST) which also appeared to be malfunctioning. I couldn't directly access any help forums or known antivirus websites either. I managed to download malware bytes, zone alarm and AVG from the CNET website and spent nearly 12 hours running scans and trying to clean things up.After all that hassle, the problem seemed to have been solved. It only lasted a few hours however, as it started acting up again. I ran Prevx which found files with the letters TDSS in them. It would only remove the infection after I accessed their website but my access was blocked. I ran malwarebytes again and found more infection, quarantined them, then ran AVG which found yet more infections. This is why I am resorting to posting an HJT log here, in hopes that someone can help.Oh, I also have another strange problem... When I use IE, some radio stations (web radio?!?) start playing on my computer totally randomly. I have to end the IE processes for it to stop. I don't know if it's related, but if someone has a solution for that as well, I'd appreciate it!I am running an HP desktop with Windows XP SP2. My default browser is Firefox. Here is t... Read more

Answer:Tdss Keeps Coming Back....

Hello Tine2105,

I apologise for the delay, the forum is busy.

Please reboot your pc before posting the new HijackThis log.
If you still need help, post a new HijackThis log.

2 more replies
Relevance 48.79%

My sister-in-law dropped off her laptop hoping I can get it to work. It kept freezing up with a fake infection warning from SpySheriff (buy-to-disinfect scam). Spybot and ewido removed gobs of infected files, but when I rebooted it was back. I ran AdAware and did another HijackThis, but I'm not yet confident to boot out of safe mode. Could somebody please tell me if there is still anything suspicious here? Thanks for your help!Logfile of HijackThis v1.99.1Scan saved at 4:43:55 AM, on 5/28/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\explorer.exeC:\WINDOWS\explorer.exeC:\Program Files\ewido anti-malware\SecuritySuite.exeC:\Program Files\Hijack This\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = htt... Read more

Answer:Spysheriff Keeps Coming Back

Hi and welcome to Bleeping Computer! My name is Sam and I will be helping you. There are still several issues that show up in your log.Download SmitfraudFix (by S!Ri) to your Desktop.Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.______________________________Open Ewido and update to the latest definition files.On the left-hand side of the main screen click the Update Button.Click on Start.The update will start and a progress bar will show the updates being installed.Once finished updating, close Ewido.If you are having problems with the updater, you can use this link to manually update ewido.Ewido manual updates. Make sure to close Ewido before installing the update.______________________________Open the SmitfraudFix folder and double-click smitfraudfix.cmdSelect option #1 - Search by typing 1 and press EnterThis program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log.

2 more replies