Over 1 million tech questions and answers.

Am I still compromised?

Q: Am I still compromised?

TL;DR I went to the website in this picture (http://puu.sh/pQ2ll/784eb6bbe8.jpg) and downloaded a file disguised as a flash update and executed it repeatedly like a moron. It opened a command prompt with a title I don't remember and closed quickly, nothing has happened since. I don't know what it did or if it's even an active threat.
 
I'll put this at the top for those disinterested in the story, I've run Malwarebytes Anti-Malware to no avail, I ran rkill.com and it interacted with nothing, and after that I did a system restore to a point two days ago. I'm aware system restore is dubious at best for virus and malware removal, but I can't think of anything more appropriate to do for something I doubt would even flag as spyware than simply factory resetting my laptop, which I still might do. It feels as if it's running slower than usual, but it's so barely noticeable that it might just be that I rebooted it for the first time in a while combined with placebo. Might I still be infected?
 
I woke up this morning and popped my laptop open, and within minutes of logging onto Steam, a person on my friends list that sends messages to me sporadically with large gaps in between sent me a link saying he found me in a video on Twitch for a game that I play very often. Being early morning, from a friend that does this often, I clicked the link, but instead of the video playing, the box simply showed the "You must update Adobe Flash Player" notice that looks exactly like it would've normally. Here's a screen cap I hesitantly went back for, to show my friend that I'm slightly less of an idiot, http://puu.sh/pQ2ll/784eb6bbe8.jpg
 
Now I just bought this laptop, so in my drunken tiredness this didn't bring up any red flags, even when I clicked on it and it downloaded a file instantly instead of bringing up the Adobe website. For whatever reason, I attempted to open the file repeatedly, and it kept popping up a command prompt with a title I don't recall and am not interested in opening it again to read. If you care enough, feel free to grab the URL from the screen cap. The stars aligned perfectly for me to fall into this trap, as I conveniently was logged out of Twitch as well so that didn't strike me as odd either. It actually didn't dawn on me that this was a phishing site until I started clicking around the page, as despite all of the buttons having the proper mouseover actions, none of them actually do anything when you click them. It was then that I opened a new tab and went to the main twitch page, logged in, refreshed the phishing page and noticed the incorrect URL, facepalmed hard enough to create a minor anomaly in spacetime.

RELEVANCY SCORE 200
Preferred Solution: Am I still compromised?

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

A: Am I still compromised?

Adware Cleaner Scan.
 
Please download AdwCleaner by Xplode onto your desktop.
Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.
 
JRT Scan.
Please download Junkware Removal Tool and save it on your desktop.
 
Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log is saved to your desktop and will automatically open.
Please post the JRT log.
 
Adware Removal Tool Scan.
 
Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.
 
 

 
Hit Ok.
 

 
Hit next make sure to leave all items checked, for removal.
 

 
 
The Program will close all open programs to complete the removal, so save any work and hit OK. Then hit OK after the removal process is complete, thenOK again to finish up. Post log generated by tool.
 
ZHP Scan.
Please download Zhp Cleaner  to your desktop.  Right Click the icon and select run as administrator.
http://ccm.net/download/download-24750-zhpcleaner
 
 
2. Once you have started the program, you will need to click the scanner button.

The program will close all open browsers!
3. Once the scan is completed, the you will want to click the Repair button.

At the end of the process you may be asked to reboot your machine. After you reboot a report will open on your desktop.
Copy and paste the report here in your next reply.
 Zemana Scan
 
 
Run a full scan with Zemana AntiMalware!
Install and select deep scan.

Remove any infections found.
Then click on the icon in the pic below.

Double click on the scan log, copy and paste here in your reply

Read other 1 answers
RELEVANCY SCORE 48

Esteemed Forum Members,

This is my first posting here. I am a Java programmer/developer. And I look forward to participating. Although I generally find that I learn more from reading the posts of the knowledgeable folks here than with me talking.

My current question is to see if anyone knows any more about a computer affliction that has affected two friends in the past week. (They are in different groups, so these are separate "afflictions".)

The two are remarkably similar so I am hypothesizing that they are basically the same attack. I suspect that if I have bumped into two of these cases, you folks may have already been there and done that.

As I don't have access to either of their computers, and as they are rather naive MSWindows users, it might be difficult for me to run the various diagnosic tools on their systems.

Basically the symptom is that they received an email from a known source. (Yeah, I know...) And clicked on a link to one of the {canxhealth health24x medhealthx xmedx } dotcom websites. The result is that, at a minimum, their Yahoo email account was compromised and an email was sent out to all of their contacts. The sent email has no subject and contains only the link to the malware website.

Googling through the web, I see suggestions ranging from changing the email account password through reformatting the hard-drive and resetting external routers. I also see claims that none of the major anti-virus/firewall applications detect this... Read more

A:Yahoo Account Compromised, possible system compromised

Hello Chuck, First i will move you one forum down to Am I Hacked.Please read the first pinned topic there, Who To Contact If Your Yahoo Webmail Account Is Hacked Next follow tese instructions,also a pinned topic there How to receive help in the Am I Hacked? forum

Read other 5 answers
RELEVANCY SCORE 48

Hello.  I seem to be sharing my firewall privileges with a remote hacker and a system restore didn't help.  A similar posting at Tom's Hardware pointed to a corrupted/malware rundll32.exe file creating extraneous malware files (guard.tmp, filename.dll) in his Win/System32 folder.  I suspect I have something similar though couldn't find those same file names.  (His posting is here: http://www.tomshardware.com/forum/134388-45-mysterious-rundll32-administrator-privileges )
 
I have tried kaspersky, combofix, rskiller, hitman, symantec, emsisoft, avg, symantec, windows defender, etc.  I am not a tech guy by trade but serve as my own IT guy some months so any help I get is welcome.  I probably am supposed to be posting "hijack this" findings or something as a first step but haven't done anything like that in 12 years so I figured I would post my problem first.  Thank you.

Read other answers
RELEVANCY SCORE 34.4

I Did a Dumb Thing!!!

I got an email message that my ATT Worldnet account had to be updated or my account would be terminated.

Since Cingular recently purchased ATT services, I thought it was legit and part of the transition of services.

I clicked on to the website, which asked for my name, password, address, phone, and credit card number. I typed in the first 4, but hesitated at the credit card line, since I pay by mail.

The site window was set up with "continue" keys. Because I did not give my credit card info, it would not continue to the next sceen. I then closed out th screen using the Windows close icon box in the upper right corner.

I called ATT and found out the website was a fraud!!!

My Question:

Since I closed out everything before reaching the "send" screen, is my name, address, and password still secure, or did that info still reach the scam artists?

I know it was a dumb mistake, but will appeciate any advice about the damage done, and what, if anything, I can do to correct it ( I ran spyware and antivirus check immediately, with no problems reported).

Thanks

adf
 

A:Is my ID compromised?

As long as you did not transmit any data to the website then your information is still secure but just to ease you mind you should go to the official website and change your password.
 

Read other 2 answers
RELEVANCY SCORE 34.4

IE is doing weird things like not allowing me to login, not allowing me to get past the first page in the forums of a website I use regularly, going very slow. I tried FF and it seems to work a little better but I get messages that I am sending over unencrypted pages even on TSG. I added a bunch of extensions but I still feel insecure. The NYTimes page comes up but I cannot get any articles to come up when I click them. I can get videos and photos but no articles. I tried FF and now it goes to a login page when I click on an article. It has never been a login sort of page.

The only out of the norm thing I have done is watch some videos of Bettany Hughes Ancient World series. After I was done my machine was slow. So I restarted it and when the desktop was up I saw a window appear that was just the upper right corner of a browser page. There were some letters the _ the box and the X. It did not respond to me clicking on the maximize box or the close X. Then it just disappeared on its own a few seconds later.

I have scanned with Avira free, Defender, and Malwarebytes all of them find nothing but neither of my browsers work properly any longer and I think I am compromised.

Any help?
 

A:I think I am compromised

Read other 16 answers
RELEVANCY SCORE 34.4

Hi,My sister downloaded a program thinking it was a utorrent program but it didn't install anything (that she knows about). Its from this page hxxp://onhax.net/utorrent-plus-crack/ Halfway down theres a green direct download link says "Crack and setup. Direct download" The file is "Crack and setup.exe" Step I've taken. I've deleted the file. I've run Adwcleaner This is the result # AdwCleaner v4.102 - Report created 27/11/2014 at 14:11:26# Updated 23/11/2014 by Xplode# Database : 2014-11-26.1 [Live]# Operating System : Windows 8.1  (64 bits)# Username : Evan - ARMYPC# Running from : C:\Users\Evan\Downloads\AdwCleaner.exe# Option : Scan***** [ Services ] ********** [ Files / Folders ] ********** [ Scheduled Tasks ] ********** [ Shortcuts ] ********** [ Registry ] *****Key Found : HKCU\Software\systweakKey Found : [x64] HKCU\Software\systweak***** [ Browsers ] *****-\\ Internet Explorer v11.0.9600.17416-\\ Mozilla Firefox v33.1 (x86 en-US)*************************AdwCleaner[R0].txt - [659 octets] - [27/11/2014 14:11:26]########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [718 octets] ##########   And I've run JRT.exe and tdsskiller.exe They found nothing..  So I'm thinking maybe the file just affected some registry tweaks. Thanks for your help. I just want to be sure that theres nothing suspicious on my harddrive. I am using Windows 8.1, its fully updated. Evan.Mod Edit by quietman7: D... Read more

A:Not sure if I've been compromised

Hello there  
 
I'm LighthouseParty and I'll be assisting you with your concern today. Please keep in mind that I have a few guidelines I need you to follow:
Don't run any other tools other than what I provide you with.
Don't install/remove any programs other than what I provide you with.
Don't perform a system restore unless I ask you to.
 Download MiniToolBox
Click here to download MiniToolBox to your desktop.
Double click MiniToolBox.
Select the following and then press go.
Post the log in your next reply.
Flush DNS
Reset IE Proxy Settings
Reset FF Proxy Settings
List Installed Programs
List Restore Points
 
 Install and run a scan with Malwarebytes Anti-Malware
Click here to download Malwarebytes to your desktop.
Double click mbam-setup-x.x.x.xxxx and follow the on-screen instructions.
On the dashboard, click update now.
After that, click scan now - the scan will now begin.
When the scan's completed, select apply actions - make sure the action is quarantine.
Restart your computer.
How to get the log.
On the dashboard, select the history tab and click application logs.
Select the log which has the time and date of when you did the scan.
Click copy to clipboard and paste it into your reply.
 Download Security Check
Click here to download Security Check to your desktop.
Double click SecurityCheck and follow the on-screen instructions.
A log should open, called checkup.txt.
Please post... Read more

Read other 4 answers
RELEVANCY SCORE 34.4

i went to amazon last night, tried to buy a gift card and got the attached warning.  amazon help couldn't tell me why he said everything is up to date. i also noticed my some of my browsers options had changed .

A:compromised ??

Possibly, but we should get a deeper look as financials are involved. Please follow this Preparation Guide, do steps 6,7 and 8 and post in a new topic.Let me know if all went well.

Read other 9 answers
RELEVANCY SCORE 34.4

I have a Sony PC running windows XP. My Zone Alarm firewall blocked iexplorer.exe trying to access the internet to some unknow IP address. I've scanned my system with AVG anti-virus and with spyware from Zone Alarm and Spysweeper but they didn't detect anything. Could I have been compromised?
 

A:Have I been compromised?

Bump
 

Read other 1 answers
RELEVANCY SCORE 34.4

Hi there,

Ried in the virus/malware section was previously helping me out. No virus/malware was detected on my system. As a result he referred me to you guys since I am still having problems. My machine started acting up after I installed RealWorld Cursor Editor. The cursor repeatedly froze up for no reason. As a result, I went ahead and uninstalled real world but the issue still continues to persist. In the interest of time, a summary of all the steps he took is posted below:

1. Tried System Restore from both Normal Mode and Windows Recovery Environment and it fails to complete.

4. Mention that issue seems to have begun after installing RealWorld Cursor, and that it had been uninstalled.

3. Reviewed detailed logs for any remnant RealWorld entries and none found.

4. Issue does not occur in Safe Mode.

A:Been Compromised again!

Hi, press the win + r key together, in the run box type:- msconfig, open the services tab and put a check in "hide all microsoft services" look at the remaining services for anything to do with the program, uncheck it and apply, also look under the startup tab anything that looks like it's associated with the program uncheck. If unsure you can still uncheck items (just leave virus and malware programs checked) If you want more info about items google OR post back.

Since that program effects Icon and mouse cursor we should try resetting the default registry settings, this will do no harm. Run the attached .zip file then double click on the returned .reg file allow to be added to registry. Restart computer.

Ico,zip.ZIP

Read other 8 answers
RELEVANCY SCORE 34.4

i went to amazon last night, tried to buy a gift card and got the attached warning.  amazon help couldn't tell me why he said everything is up to date. i also noticed my some of my browsers options had changed
 attach.txt   8.68KB
  0 downloads
 
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17207  BrowserJavaVersion: 10.51.2
Run by Bobz at 16:03:58 on 2014-07-16
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.8182.5220 [GMT -7:00]
.
AV: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\sy... Read more

A:compromised ??

Hello and Welcome on board Bobz1x,my Name is Machiavelli and I will assist you with your problem.If you booted into safe mode on your computer then print my instructions!I'm in the 'Malware Staff Team' and will provide you with advice:To remove Malware on a computer can be very complicated. Malware (malicious software) is able to hide and so I may not be able to find it so easily. In order to remove Malware from you Computer, you need to follow my instructions carefully. Don't be worried if you don't know what to do. just ask me! Please stay in contact with me until the problem is fixed.Below are a few tips:Removing Malware is usually very difficult.We need to search and analyse a lot of files. As this is done in our free time, please be patient especially if I don't answer every day!Please follow these instructionsIf you don't follow the instructions your computer may crash. If you fix your PC by yourself, this can be very risky!Please stay in contact with me until your problem is resolvedAs Malware may not be totally removed in one session or in one day, please stay in contact with me until the problem is resolved.Please don't run any other tools without consulting with me as this can complicate finding and removing all MalwareDon't run any tools while I'm fixing your PC. That is counter productive and again, will only complicate finding and removing all Malware!Read my post completelyIf you don't do so, you may make mistakes that could result in your System crashing by you... Read more

Read other 13 answers
RELEVANCY SCORE 34.4

Why am I getting buried here?
 

A:Compromised...but not sure how or how bad...help please

I know I got some bad spyware from somewhere and keep getting all kind of weird notifications from spyware doctor that something has been blocked. Also I get notification that programs could not start at start up. I then run a scan with Spywaredoctor or superantispyware or adaware and it seems to get rid of the problem, but the next time I start up there is a new problem. The most recent one is "TA_start failed to begin correctly at start up" or something such. I feel like I'm killing the weeds but not the root.

I downloaded hijackthis and made a log. Hopefully it has everything needed. Spywaredoctor tried to blaock something it was doing.

Any help you can provide would be super.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:22:55 PM, on 6/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\asuskbservice.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Avid\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Nort... Read more

Read other 3 answers
RELEVANCY SCORE 34.4

Hi,

For the past 3 days my computer has been acting up for no apparent reason. Something is horribly wrong with the system volume. Each time I hit the volume button the bar increases/decreases asynchronously. In other words, the volume continues to increase/decrease long after the f10/f9 buttons have been released. If this weren't enough windows seem to open and close by themselves without warning. In addition, while typing, parts of paragraphs magically highlight themselves and then erase at will in the midst of completing an entire sentence. Since the system can be recovered at anytime, I did not take the trouble of compiling a boot cd. It looks like I've been compromised! Any help is much appreciated. In compliance with the wishes of the moderator I have posted/attached the following logfiles.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_27
Run by SHAHJEE at 15:19:14 on 2011-11-06
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3894.925 [GMT -8:00]
.
AV: Kaspersky Internet Security *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Enabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\... Read more

A:Been Compromised!

Hello and welcome back to TSF Virus & Malware support. My name is Taylor and I'll be helping you with your fix.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please be patient with me during this time.

Read other 4 answers
RELEVANCY SCORE 34.4

I received one of these scam "I need money" emails from a friend and immediately realised that her computer had been hacked. I replied telling her so.Now I have received another email from her with a new email address saying that since she was hacked she had been unable to receive anything at the original address, she thinks everything went to the hackers. I am just wondering whether my response to the original email has put me at risk and if so what should I do bout it or is it too late.
Nita
 

A:Am I compromised

Read other 6 answers
RELEVANCY SCORE 34.4

i run trend paid internet security 2010 .. a colleague was hit by gumbar and another by hacktool rootkit ... my machine slowed to a crawl last night, minute between clicks .. but a reboot and i 'seem' to be running normally and have had a clean scan from that, prevx, and malwarebytes, but I'm still paranoid, so I really appreciate any insight into the logs I'm posting per the instructions here http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ (i included hijackthis log too just in case)i'm on a vista 64bit .. and running GMER, i only had services/registry/files / ADS available for selection.. system devices.. etc .. all were grayed out.DDS (Ver_09-12-01.01) - NTFSX64 Run by websitewendy at 11:55:02.28 on Thu 02/18/2010Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_16Microsoft? Windows Vista? Home Premium 6.0.6001.1.1252.1.1033.18.4094.1108 [GMT -8:00]SP: Windows Defender *enabled* (Updated) coloro:red4============== Running Processes ===============C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k rpcssC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\SLsvc.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC... Read more

A:have i been compromised ?

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.We need to create an OTL ReportPlease download OTL from one of the following mirrors:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.In the custom scan box paste the following:CODEnetsvcsmsconfigsafebootminimalsafebootnetworkactivexdrivers32%systemroot%�... Read more

Read other 15 answers
RELEVANCY SCORE 34.4

Need help getting rid of the bad guys

Here is my HJT log


Logfile of HijackThis v1.97.7
Scan saved at 5:12:55 AM, on 7/18/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\LAUNCHER\CTLAUNCHER.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\AHQ\CTMIX32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\QUICKENW\QWDLLS.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\OLYMPUS\CAMEDIA MASTER 4.0\CM_CAMERA.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\PLAYLIST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MOTIVE\ASSTCOMMON\MOTIVEDIRECTORY.EXE
C:\PROGRAM FILES\SBC SELF SUPPORT TOOL\BIN\MAD.EXE
C:\PROGRAM FILES\SBC SELF SUPPORT TOOL\BIN\MPBTN.EXE
C:\PROGRAM FILES\SBC SELF SUPPORT TOOL... Read more

Read other answers
RELEVANCY SCORE 34.4

I had a post in another forum, but after running MBAM(no results). I thought I should post in here. If not, my apologizes, please move me to the correct area. My daughter plugged into a USB port, some cheapo camera she had. I got an error message on my screen(don't recall). I rebooted and now my CPU fan seems like it is about to launch. Any and all advice is appreciated. My 9 year is upset, she thinks she broke it. THANKS!

A:I think my Pc might of been compromised.

Hello is this an XP PC or another? The error message would help if you see it again. Open the Tazk Manager (press CTRL+ALT+DEL). Click on Processes Tab and is something using a lot of your CPU ?Run ATF and SAS:From your regular user account.Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..DO NOT run yet.Open SUPER from icon and install and Update itUnder Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.Now reboot into Safe Mode: How to enter safe mode(XP)Using the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Double-click ATF-Cleaner.exe to run the program.Under Main "Select Files to Delete" choose: Select All.Click the Empty Selected button.If you use Firefox or Opera browser click that browser at the top and choose: Select AllClick the Empty Selected button.If you would like to keep your saved password... Read more

Read other 6 answers
RELEVANCY SCORE 34.4

I really hope someone can help me. I am using windows XP and lately it has been doing everything imaginable. It started with opening web pages completely unsolicited. Then it would redirect pages that I was on and try to install things.After that it would not open some web pages unless I allowed all cookies and lowered the privacy to LOW. It Automatically closes some programs for no reason, sometimes it just restarts whenever. The last time that happened it removed all my settings and if I reset them it does not keep them and I have to start all over again. I have even had to reinstall my internet connection and email. It does not even save my desktop display. Everytime I look directly under the C drive I have all kinds of applications there which I continulaay delete. Oh, and it is so slow, it has 512 MB and 1.8 GHz with 80 GB HD.

I have run AntiVir and it claims that there are no viruses, or trojan horses ot anything else, I ran HiJack this, I ran cwshredder and it says that there is nothing. I don' know what to do!!! Please someome help me?
 

A:Very compromised PC

Read other 16 answers
RELEVANCY SCORE 34.4

I attempted to follow the malware prep guide but stalled out on step 7 when DDS would not run. I followed the threads in the forums to download and run RSIT and have posted the logs below. I have also included the inital logs for recent events from Norton Internet Security which keeps flagging and removing local virus and blocking attacks from the internet. Any help is greatly appreciated.My basic problem is that Norton is locating and eliminating a virus every time I boot my pc. Norton also picks up and blocks some internet attacks everytime I attach to the internet. However each time I restart my pc the virus re-appears.thanks!NORTON RECENT SCAN DATA:Category: BackupDate & Time,Severity,Activity,Status,Recommended Action,Action,Location,Media Type5/15/2010 10:00 PM,Info,Backup performed to I:,"Canceled, Canceled",None,Backup,I:,CD/DVD DriveCategory: Firewall - Network and ConnectionsDate & Time,Severity,Activity,Status,Recommended Action,Subnet Identifier,Gateway Physical Address,Category,Gateway IP Address5/15/2010 9:45 PM,Info,Connected to a protected network. (127.0.0.0/255.0.0.0),Protected,No Action Required,127.0.0.0/255.0.0.0,,,5/15/2010 9:45 PM,Info,Connected to a shared network. (00 12 17 C5 E0 D9),Trusted,No Action Required,,00 12 17 C5 E0 D9,,5/15/2010 9:45 PM,Info,"Protecting your connection to a newly detected network on adapter \"Realtek RTL8169/8110 Family Gigabit Ethernet NIC - Packet Scheduler Miniport\" (IP ad... Read more

A:PC has been compromised

Hello and welcome to Bleeping Computer! We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Fo... Read more

Read other 2 answers
RELEVANCY SCORE 34.4

Hoping someone can provide some assistance here.... need system analyzed. Have compiled logs & data for troubleshooting...

Windows XP Home v 2002, SP 3
Intel Celeron 2.4 GHz
2.39 GHz , 256 MB RAM
Hard wired to : Arris Modem #TM502G---->Buffalo High Power AirStation A&G: (NAT enabled & PNP disabled, Intrusion detector enabled, etc... MAC filtered, not broadcasting SSID, etc...) ---->Motorola VT1005 (set statically)---->PC (Broadcom 440x 10/100 Integrated Controller w/TCP/IP set statically, and NetBios disabled)
Agnitum Outpost Firewall Pro ver. 4.0.971.7030 (584): (Stealthed as much as I could without sacrificing connectivity)
Avast! v. 4.8 Home Addition Build Dec. '08 (4.8.1296) : (Stealthed)
ProtoWall : (need to update lists, there are a few certain sites I have to disable ProtoWall to visit...)

Wondering if all my PC issues aren't due to my system being compromised. Have been running extensive scans. Are you familiar with analyzing any of the following logs: DrWeb, FPort, HijackThis, RootkitRevealer, StartDreck, SpyBot S&D?

Strange thing that occured though, right after I started noticing these issues, I received an email from my web host provider, stating that one of my websites had been compromised and my web page had changed, here is what they said:

"Recently, we noticed that your username and password for your ftp account hosting has been used by someone to alter your main index.html (or index.htm, index.php) file for ... Read more

A:Has My PC Been Compromised?

You have done most everything that we can recommend in this particular forum. HJT logs should not be posted hereWe have a revised procedure for HJT that you should read first:http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/Then post the log in the proper forum here:http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

Read other 3 answers
RELEVANCY SCORE 34.4

Hi,
Once again, I have been forced to ask for help. Allayed by the fact no infections were found on my machine earlier I soon relapsed into complacency. But almost immediately my solace was short-lived. For the past 1 week my computer has been acting up for no apparent reason. Something is horribly wrong with the cursor and application tabs. At times my cursor refuses to do what I want. I keep clicking away at 'x(s)' but application windows just sit there frozen. Instead of closing out, my cursor freezes up. Then yesterday my comp. simply blacked out. A message reading ' Not compatible with windows 64-bit....' mysteriously appeared but on restarting the computer it was gone. Pulling on scroll bars using the cursor is another goof-up. No matter how hard I try, scroll bars refuse to pull up or down. After several tries the picture gives way. I have a penchant for watching youtube videos ( engineering simulations). Is it possible that may be the culprit? Anyhow, I have posted/attached the following logfiles.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_27
Run by SHAHJEE at 15:19:14 on 2011-11-06
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3894.925 [GMT -8:00]
.
AV: Kaspersky Internet Security *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-D... Read more

A:Been compromised again!

"BUMP, please"

Read other 19 answers
RELEVANCY SCORE 34.4

Recently my son went on my pc and clicked a link over discord from someone he didnt know. The file was 011.exe. This in turn gave someone full access of my pc and i want to know what to do and if a factory reset will get rid of this persons connection to my pc
 

Read other answers
RELEVANCY SCORE 34.4

Hey guys, my computers been acting really slow and strange lately. It also has a new user called IUSER_Admin on it.

Here is the log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:41:33 PM, on 10/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\AFinding.exe
C:\WINDOWS\system32\afisicx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\mabidwe.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\macidwe.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOW... Read more

A:HELP i think i have been compromised!

Hello and welcome to TSF

==========
Download RSIT by random/random and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

============
Logs Required
log.txt
info.txt

If there is no response to this post within 72hrs, this thread will be closed.

Read other 6 answers
RELEVANCY SCORE 34.4

Hi there

My system has been compromised just recently and would like your help on the matter.

Here's what I've done so far: Installed and ran "CCleaner", removed whatever it found. Did the same with "Ad-Aware" and it actually found some trojan of some sort and removed it. Then I intalled "Spybot Search & Destroy" and did a search with that one. And finally I ran a virus check with "NOD32" and topped it off with "MalwareBytes' Anti-Malware". "NOD32" found some trojans in "Java" which I deleted manually and did a new search, where nothing showed up. I've got logs of the Java trojans. So I've updated "Java" now as well, so that hopefully will close any security holes.

So I'll post a log from MBAM and HJT and would really appreciate your opinion on this matter. Are my system okay now, or can you still see something?
Thank you.

Malwarebytes' Anti-Malware 1.44
Database version: 3874
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

16-03-2010 23:58:52
mbam-log-2010-03-16 (23-58-52).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 187944
Time elapsed: 20 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No... Read more

A:Compromised

Hello and welcome to TSF.

HijackThis is no longer the preferred initial analysis tool in this forum.

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Read other 1 answers
RELEVANCY SCORE 34

I recently left my computer unattended (6-Jun) and for some reason the system did not lock after the first few minutes of inactivity. I have reason to believe my machine may have been tampered with. I'm concerned a keylogger may have been installed. Not sure that's what it's called but basically spyware that reports back to someone what's being done on a computer. A colleague's crazy ex did something like this to her.

Not to sound like a patient in a doctor's office with a vague symptom like fatigue but my laptop is running very slow and always seems to be chugging away at something (sounds like it's continually accessing the hard drive).

Many thanks in advance for any help you can offer ... it will help me sleep at night! Following is the log from DDS and attached are the logs from DDS and GMER.

DDS (Ver_09-05-14.01) - NTFSx86
Run by Owner at 16:17:03.73 on Thu 06/11/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.214 [GMT -4:00]

AV: Trend Micro Internet Security *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: Trend Micro Personal Firewall *enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C... Read more

A:Security Compromised

Hello timetraveller61,

I'm not seeing any malware in your logs, let's see if an online scan reveals anything. It can take some time, so please be patient and allow it to run it's full course:


Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html

1. Click Accept, when prompted to download and install the program files and database of malware definitions.


2. To optimize scanning time and produce a more sensible report for review:Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.



Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Read other 10 answers
RELEVANCY SCORE 34

Last night I registered weightlifting.ws with godaddy. I have a hosting account with IPS Boards, and I pointed my domain to their servers. This morning I decided to host the domain on my godaddy hosting account. I reset the DNS back to godaddy, and installed SMF. After smf was installed, I tried to access the site from my laptop, but couldn't.

I can access the site from my other laptop and desktop, but not my laptop. ***?? I also have friends that can navigate to the site, but I can't pull the site up on my laptop ***?? First I cleared the browser history and cache, didn't work. I tried to open the site in Chrome and Explorer, but didn't work. I deleted the browsers and re-installed, didn't work. I cleaned my computer with Glary Utilities, and ran a scan with MS Security Essentials. Nothing has worked...***??

Read other answers
RELEVANCY SCORE 34

Hey TSF,

I got an e-mail today stating that my Valve Steam Account had the email address and password changed without my consent. I'm mildly worried that the problem is on my computer at college rather than at home, and I'm unsure if I have a keylogger or trojan or other such malware. My school mandates the use of Windows Defender and Symantic Antivirus; I keep spybot running, and I run Malwarebyte's every once in a while. Please let me know if I have something to worry about.

Logs are attached, and I'm now at your mercy.

DDS (Ver_09-02-01.01) - NTFSx86
Run by KRUG_JONA at 22:36:02.70 on Tue 03/03/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2014.853 [GMT -5:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\... Read more

A:Possibly compromised?

Bump, please

Read other 10 answers
RELEVANCY SCORE 34

Hi

My system has been compromised just recently, so I've used different software to scan my drives and they found something and removed it.

Now I've followed your instructions and have used dds and gmer (sorry for that post before ). So I would appreciate if you looked through my logs and told me if you see something suspecious.

Thank you.


DDS (Ver_10-03-17.01) - NTFSx86
Run by Hense at 16:00:15,18 on 18-03-2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1033.18.3071.2407 [GMT 1:00]

AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\NVI... Read more

A:My system has been compromised

Howdy there and welcome to TSF Forums

I'm Steve and I will be helping you thoughout this fix.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step. Please perform everything in the correct order/sequence.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription

Please note that the forum is very busy and if I don't hear from you within three days from this initial post then thread will be closed.

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Please download DeFogger to your desktop.

Double click DeFogger to run the tool. The application window will appear
Click the Disable button to disable your CD Emulation drivers.
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Please rescan with GMER

Double cl... Read more

Read other 10 answers
RELEVANCY SCORE 34

ctfmon.exe fails to initialize in limited user accounts. I suspect a malware infection, thought I'm obviously not sure. If anyone can help me configure Comodo to prevent further problems, that would also be appreciated. I didn't install SpywareBlaster or IE-Spypad because I mostly use Opera; but said limited users may benefit from them. Also did not remove Viewpoint Manager since it seemed to be integral to several applications. Other instructions followed in full. Suggestions?

Deckard's System Scanner v20071014.68
Run by Matt on 2008-02-24 00:26:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
84: 2008-02-24 05:27:35 UTC - RP1212 - Deckard's System Scanner Restore Point
83: 2008-02-23 17:51:38 UTC - RP1211 - Software Distribution Service 3.0
82: 2008-02-23 17:41:05 UTC - RP1210 - Software Distribution Service 3.0
81: 2008-02-23 17:22:16 UTC - RP1209 - Software Distribution Service 3.0
80: 2008-02-23 17:15:08 UTC - RP1208 - Software Distribution Service 3.0


-- First Restore Point --
1: 2007-11-26 22:52:53 UTC - RP1129 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 511 MiB (512 MiB recommended).
System Drive C: has 10.09 GiB (less than 15%) free.


-- Hijack... Read more

A:ctfmon.exe compromised?

Aaand I've got a smiley in my log. Oops.

Read other 6 answers
RELEVANCY SCORE 34

ARGH! Auto updates will not close. Every time I try to end the process (wuauclt.exe), it just pops right back up again - usually in triplicate! I downloaded a security update released today (Bits update and the Intelligent Update Service) and now it won't go away. Is it compromising my security while it's annoying me? And since that update has been installed, NAV (2003) keeps telling me that it doesn't have access to c: but it does. Nothing is restricted that wasn't before.....
thanks
Kim (aka lost)
 

Read other answers
RELEVANCY SCORE 34

Hi all,

My brother-in-law's computer is so compromised that you can't even keep it powered on. He runs XP...not the home version. He has a cable modem and no firewall. When he clicks on his username, it logs him on and then shuts him down right away. I'd love to have him run a HijackThis log and post it here, but if he can't even power up, what can he do? I'm posting for him since he can't get on. Any advice?
 

A:Majorly Compromised!

Read other 9 answers
RELEVANCY SCORE 34

Hi! I posted a log a while back for a different computer and ended up replacing that one, but now I'm afraid my laptop may now be infected.Can someone please take a look at my logs & let me know if I have anything remaining? I ran Malwarebytes Anti-malware and it removed a few items, but my computer is still acting strangely.Thank you in advance!Logfile of Trend Micro HijackThis v2.0.4Scan saved at 1:14:41 PM, on 10/13/2010Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\WLTRYSVC.EXEC:\WINDOWS\System32\bcmwltry.exeC:\WINDOWS\system32\spoolsv.exec:\drivers\audio\r211990\stacsv.exeC:\Program Files\Cisco Systems\VPN Client\cvpnd.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exeC:\WINDOWS\system32\DRIVERS\o2flash.exeC:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exeC:\Program Files\Dell Support Center\bi... Read more

A:Computer may be compromised

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below I will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Follow the ... Read more

Read other 2 answers
RELEVANCY SCORE 34

I've found some stuff in my processes/netstat that I dont know what is, I've tried googlein' but cant find a straight forward answer.

I have a TCP epmap and UDP isakmp connetion?!

Neither of which do I remember installing. The reason why I find this a bit doggy is the fact that my websites ftp server appeared to be hacked. A file named 'Akamai' appeared in a read only area where no files should be created with the text saying 'Ok' in the document (answering the notice i guess saying that you cant write files). A few days ago I was looking at my open connetions and I noticed one with the name "host13.akamai-hex.....", funnt i thought, thats the same name!! I did a port scan just so I could see what kind of system it was, and its linux, (what a supprise!) with services such as ssh, smtp, http & https (has a website running from the machine?) as well as pop3 and .... ISAKMP.

I recon my, well not mine, my parents computer.. (my computer is still up at uni..) has been "Owned". What do you guys make of that? Im not sure what to do, my parents dont have a real firewall (ive told them hundereds of times they need one!) so ive put on ZA for them, but its their free version, and it doesnt allow individual program control.

What do you guys recon i should do?

- I've:

updated thier windows XP
updated their AV
installed ZA
installed Spybot Search and destroy
ive changed the registry to save only the new NT password types
changed their user p... Read more

A:System compromised?

Also.. they have reported the computer turning on by itself, all though i have not seen this myself.

Thanks for any help, C0B01

Read other 3 answers
RELEVANCY SCORE 34

Hi,

I'm a new member of this forum, and I have a problem with my Norton Internet Security 2004 Professional. I keep getting pop-ups and the Norton is not functioning properly. I tried to uninstall to reinstall it, but it wouldn't let me do that. Meanwhile, whenever I open my browser, pop-ups appear and it changes my homepage to about:blank (spyware). I would really appreciate any help you can provide. Thanks for your time.
 

A:Norton compromised, plus pop-ups

Read other 16 answers
RELEVANCY SCORE 34

I've been on the phone off and on with the Symantec folks for hours, and I'm fed up and frustrated.

The virus definitions won't update---installation fails. The techs know, we've re-installed 3 times, 3 different ways.. and it still fails.

Anyone else ever have this problem? The techs don't seem concerned that it's a virus, etc. that may have caused the problem. And I do an online virus scan occasionally just to be sure.

I'm using Norton Internet Security 2006 with Windows XP. We bought Norton about a month or two ago, so it's not like we can take it back.

I'm just stumped as to what to do. I can't spend my entire life on the phone with these people, and I thought maybe---just maybe---you guys might have an idea for me.

Thanks.
 

A:Norton compromised?

Read other 9 answers
RELEVANCY SCORE 34

I know what to do to resolve this issue. Admin please delete this thread.

A:My email has been compromised

What did you need to do? Was it an actual hack on your mail account, or the result of an infection? If an infection, was it on a mobile device as shown by the "34945-MOBILE" portion of the header or was it on a local machine. Please post a follow up so that other users may benefit. Thanks.

Read other 1 answers
RELEVANCY SCORE 34

Been fighting this for a week and I can't find anything actually wrong, but I know something has to be there. My Warcraft account was recently hacked and based on some of the actions of the hacker I have to assume that they have gained access to my computer. Not only have they gotten my login information everytime I change it, but they have gotten some files submitted to Blizzard. Despite running multiple virus and malware scans nothing has ever come up. I am reluctant to simply reformat because I would like to at least try to understand how this has occured, but you can't fix what you can't find.
 
 
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16750  BrowserJavaVersion: 10.45.2
Run by troy at 1:30:21 on 2014-01-14
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.4094.1950 [GMT -6:00]
.
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\svc... Read more

A:Computer Compromised

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/520819 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

Read other 17 answers
RELEVANCY SCORE 34

Hello first time here im not sure if im infected but have had trouble installing updates and validating windows i ran farbars tool and it points to registry keys that have no file and require attention i have deleted those keys but they just re-appear i wonder if  someone could look at the logs and advise me
                                        thanks Graeme

A:I think my laptops been compromised

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Press the windows key + r on your keyboard at the same time. This will open the RUN BOX.Type Notepad and and click the OK key.Please copy the entire contents of the code box below to the a new file. start
CreateRestorePoint:
EmptyTemp:
CloseProcesses:

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3518170916-4175138910-237300894-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> DefaultScope value is missing
CHR Extension: (Google Wallet) - C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-24]
CHR HKLM-x32\...\Chrome\Extension: [aeihoglbpfedbnjbinigheaelfnlhlni] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1308\ch\MediaViewerV1alpha1308.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [kboiegcaohjmgmjeggcopjchdhhckcco] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha2725\ch\MediaViewV1alpha2725.crx <not found&... Read more

Read other 8 answers
RELEVANCY SCORE 34

My e-mail account has been sending out e-mails to everyone in my address book and even to my online banking sight with links attached to the e-mail. then i keep getting mailer daemons in my inbox. did someone hack into my e-mail or do i have a tojan? whats wrong and how do i fix it?

A:is my e-mail compromised?

Download the following:Malwarebytes Anti-MalwarePlease download Malwarebytes Anti-Malware and save it to your desktop.Download Link 1Download Link 2MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.Make sure you are connected to the Internet.Double-click on mbam-setup.exe to install the application.
For instructions with screenshots, please refer to the How to use Malwarebytes' Anti-Malware Guide.When the installation begins, follow the prompts and do not make any changes to default settings.When installation has finished, make sure you leave both of these checked:Update Malwarebytes' Anti-MalwareLaunch Malwarebytes' Anti-MalwareThen click Finish.MBAM will automatically start and you will be asked to update the program before performing a scan.If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.On the Scanner tab:Make sure the "Perform Quick Scan" option is selected.Then click on the Scan button.If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.The scan w... Read more

Read other 1 answers
RELEVANCY SCORE 34

Hi everyone, yahoo account was compromised. not sure how it happened... im an 'intermediate' user fwiw. i ran malwarebytes, adaware, spybot, and avg in safe mode but i am very concerned that this happened. so i ran a hijack scan and would be truly grateful for any advice anyone can give me. thank you for reading and have a lovely day! oh and i have followed the instructions to disable cdemulators and will do whatever is asked, of course.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:39:04 AM, on 11/7/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
D:\WINDOWS.0\System32\smss.exe
D:\PROGRA~1\AVG\AVG2012\avgrsx.exe
D:\Program Files\AVG\AVG2012\avgcsrvx.exe
D:\WINDOWS.0\system32\winlogon.exe
D:\WINDOWS.0\system32\services.exe
D:\WINDOWS.0\system32\lsass.exe
D:\WINDOWS.0\system32\nvsvc32.exe
D:\WINDOWS.0\system32\svchost.exe
D:\WINDOWS.0\System32\svchost.exe
D:\WINDOWS.0\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
D:\Program Files\AVG\AVG2012\avgwdsvc.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS.0\system32\CSHelper.exe
D:\WINDOWS.0\system32\svchost.exe... Read more

A:email compromised

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/426724 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

Read other 23 answers
RELEVANCY SCORE 34

I have multiple online accounts with my credit cards, credit unions, stores, and various applications.  I use different passwords for all of them.
 
For the past couple of weeks I have gotten a few seperate fraud notifications on different accounts. I have also had MULTIPLE websites reset my password or ask me to login to reset my password. I never use links in emails to do this and it is confirmed directly when I get to the site that this is in fact true.
 
I am not sure how my accounts/identity have been compromised or what to do. Could someone please advise?

A:I think my accounts have been compromised

Based on the Law of Total Probability, (http://en.wikipedia.org/wiki/Law_of_total_probability) with "common application of the law is where the events coincide"
You have spyware/malware with keystroke capabilities. Start a topic here, http://www.bleepingcomputer.com/forums/f/103/am-i-infected-what-do-i-do/ for assistance.

Read other 4 answers
RELEVANCY SCORE 34

Hi all,

I'm currently working on riding my desktop computer and laptop of all their evils and I became curious about something. Let's say that your computer/computer network has been hacked by someone. What are they capable of doing once you've disconnected yourself from the network? Would that person/people be able to remotely access my computer and files still? What would happen if I reconnected to the internet again? Would I be safe if I were to connect to a different network than the network you were originally on when your machine was compromised? If one compromised machine is reconnected to a network that a "clean" computer is on, does that mean that system is compromised/people have access to it as well?

I've already taken a look at the tutorial on How can you figure out if you've been hacked? and I think for the time-being it's beyond my capabilities/knowledge to pull it off (otherwise I would not be posting, of course). Sorry if you feel this post is misplaced - I wasn't sure if I should group it with malware issues or in the networking forum.

Thanks for any responses!

S.

A:What can you do if your system is compromised?

This allows hackers to remotely control your computer, steal critical system information and download and execute files.I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?When Should I Format, How Should I ReinstallWe can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.ReformattingYour decision as to what action to take should be made by reading and asking yourself the questions presented in the "When should I re-format?" and What Do I Do? links I previously provided. As I already said, in some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. ... Read more

Read other 2 answers
RELEVANCY SCORE 34

Hello,

I'm hoping I can get a second opinion to a question I posed on the MS Win7 Forum. The answer seemed to go against what I've read on numerous computer security sites regarding different software to have. Also mentioned was "first I would dump anything Norton", many sites gave it extremely high marks, but anyway. It seemed reply was all negative without answering question. Here is what I posted, and His answer, Hope this is okay.

One thing I didn't think to add to original question was that I'm using Norton Safe Search in toolbar if that matters. _______________________________________________________________________________________________________________________________________________________________
Is my computer compromised?

Win7, IE9, Norton Internet Security 2011, (Malwarebytes, SuperAntispyware, and Ad-Aware, I only use the ones in brackets as secondary scans and not actively running.

I notice sometimes at many different websites my toolbar will what I say is "move down a step" and leave a blank like toolbar (empty of course) above it just below the address bar.

I'm using Norton Internet Security 2011, and have Malwarebytes, SuperAntispyware, and Ad-Aware as just secondary scanners. I keep everything updated at least weekly, though Norton automatically updates on its own the same as Windows. Everytime I do scans (weekly) they all come up clean.

With the toolbar moving down leaving an empty space between ... Read more

Read other answers
RELEVANCY SCORE 34

Hello, i think I am another one of the unfortunate who have encountered this root toolkit issue. I am new to this forum and reading the various postings and support, the effort and quality of responses is really commendable. I've tried to follow the preparation guide protocol and performed the various steps. Your help is greatly appreciated. Regards, Nicoray.

I was running AVG, which i have now uninstalled. It identified various trojans but only gave me the ignore option. I also had malwarebytes, so i updated it and ran it several times in safe mode and regular win 7 32 bit mode and each time it identifies various trojans and removes them. but on reboot and internet connect, they always come back. Also ran TDSKiller.

Thanks again.

A:Services.exe seems to be compromised

Hi, please run the following:download Farbar Recovery Scan Tool and save it to a flash drive.Plug the flashdrive into the infected PC.Enter System Recovery Options. To enter System Recovery Options from the Advanced Boot Options:Restart the computer.As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.Use the arrow keys to select the Repair your computer menu item.Choose your language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account and click Next.To enter System Recovery Options by using Windows installation disc:Insert the installation disc.Restart your computer.If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.Click Repair your computer.Choose your language settings, and then click Next.Select the operating system you want to repair, and then click Next.Select your user account an click Next.On the System Recovery Options menu you will get the following options:Startup RepairSystem RestoreWindows Complete PC RestoreWindows Memory Diagnostic ToolCommand Prompt[*]Select Command Prompt[*]In the command window type in notepad and press Enter.[*]The notepad opens. Under File menu select Open.[*]Select "Computer" and find your flash drive letter and close the notepad.[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst... Read more

Read other 23 answers
RELEVANCY SCORE 34

Hello everybody!

I finally removed Spyware Protect 2009 from my computer with Malwarebytes, and just wanted to know if my personal info (banking records, etc..) can be accessed by others on the web. I don't see any TDSS/backdoor.bot, soo... idk, just want to be sure. Any help is appreciated. Here is my log:
Malwarebytes' Anti-Malware 1.33
Database version: 1733
Windows 5.1.2600 Service Pack 2

2/5/2009 8:31:53 PM
mbam-log-2009-02-05 (20-31-53).txt

Scan type: Quick Scan
Objects scanned: 75586
Time elapsed: 19 minute(s), 59 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 4

Memory Processes Infected:
C:\WINDOWS\sysguard.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\iehelper.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c9c42510-9b21-41c1-9dcd-8382a2d07c61} (... Read more

A:Is my computer compromised?

Hi DAUeleven and welcome to BCPlease print out and follow these instructions: "How to use SDFix". When using this tool, you must use the Administrator's account or an account with "Administrative rights"Disconnect from the Internet and temporarily disable your anti-virus, script blocking and any real time protection programs before performing a scan.When done, the SDFix report log will open in notepad and automatically be saved in the SDFix folder as Report.txt.If SDFix is unable to run after rebooting from Safe Mode, run SDFix in either Mode, and type F, then press Enter for it to finish the final stage and produce the report.Please copy and paste the contents of Report.txt in your next reply.Be sure to renable you anti-virus and and other security programs before connecting to the Internet.-- If the computer has been infected with the VirusAlert! malware warning from the clock and the Start Menu icons or drives are not visible, open the SDFix folder, right-click on either the XP_VirusAlert_Repair.inf or W2K VirusAlert_Repair.inf (depending on your version of Windows) and select Install from the Context menu. Then reboot to apply the changes.

Read other 1 answers
RELEVANCY SCORE 34

This PC is on same Workgroup as a hacked PC that was compromised by an undetected rootkit that resulted from an email Trojan that was accidently opened, Detected by McAffee System Security and removed, but obviously not before damage was done! That box has since be re-formated and OS re-installed. Shortly afterwards our bank account were hacked and we were hit hard! Bank has got it all back and forensics team is working with us to see how it happened. In the mean time I need to know if this PC is clean!

DDS attached!Looks like the GMER LOG did not save for reason. I will scan and attached again/ Please do not take that as a BUMP! Requires all Anti-virus protection to be off to run or else program fails. So I disable DSL adapter while it running.

A:Suspected Compromised Box!

GMER Log Added (Not a Bump)
--------------------------
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-01-15 23:26:43
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HM320JI rev.2SS00_01
Running: GMER-phc72dyg.exe; Driver: C:\Users\Medion\AppData\Local\Temp\pgliaaob.sys
---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwAssignProcessToJobObject [0x93540080]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwCreateFile [0x93540BDE]
SSDT \??\C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\34302\RapportCerberus32_34302.sys ZwCreateThreadEx [0x8CF59640]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteFile [0x93540DD6]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ZwDeleteKey [0x935445AC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys ... Read more

Read other 13 answers
RELEVANCY SCORE 34

I am writing today concerning a few issues.

I recieve a Linksys Wireless NetWork Monitor Win 3R error Code 997 sometimes is says Linksys Wireless NetWork Monitor Win 3R eroor Code 997 overlapped I/O operation in progress. Either way it shuts down my browser , sometimes it shuts down my internet usage.

Some times the menu bar on the bottom of my screen changes from blue to grey
My computer runs slowly, at times it will not complete a shut down

My administrator side of my computer has vanished

my norton and windows can not preform a back up

I can not do updates

My computer is running extremely slow at times.

The first log requested doesnt appear in a language I can read, Am I using an outdated notepad? DDS scan

L?!This program cannot be run in DOS mode.

edit seems i saved the file while it was still scanning , the dds scan file save isnt allowed to be attached. I must have made an error on that , i will reattempt. The GMER scan recieved an error code and shut down so the attachment still isnt complete scan.

Error Signature
App Name gmer.exe AppVer 1.0.15.15641 ModName: ntdll.dll
Mod Ver: 5.1.2600.5755 OffSet: 0001101a
Reporting Details This error includes: information regarding the condition of gmer.exe when the problem occurred: the operating systen version and computer hardware in use, your digital product ID, which could be used to identify your license , and the protcol(IP) address of your computer.
Exception Information:
Code 0xc0000005 Flags 0x... Read more

A:System compromised

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything. We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here. To help Bleeping Computer better assist you please perform the following steps:*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/431104 <<< CLICK THIS LINK If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.*************************************************** If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lo... Read more

Read other 22 answers