Over 1 million tech questions and answers.

Very compromised PC

Q: Very compromised PC

I really hope someone can help me. I am using windows XP and lately it has been doing everything imaginable. It started with opening web pages completely unsolicited. Then it would redirect pages that I was on and try to install things.After that it would not open some web pages unless I allowed all cookies and lowered the privacy to LOW. It Automatically closes some programs for no reason, sometimes it just restarts whenever. The last time that happened it removed all my settings and if I reset them it does not keep them and I have to start all over again. I have even had to reinstall my internet connection and email. It does not even save my desktop display. Everytime I look directly under the C drive I have all kinds of applications there which I continulaay delete. Oh, and it is so slow, it has 512 MB and 1.8 GHz with 80 GB HD.

I have run AntiVir and it claims that there are no viruses, or trojan horses ot anything else, I ran HiJack this, I ran cwshredder and it says that there is nothing. I don' know what to do!!! Please someome help me?

RELEVANCY SCORE 200
Preferred Solution: Very compromised PC

I recommend downloading and running Reimage. It's a computer repair tool that has been proven to identify and fix many Windows problems with a high level of success.

I've used it in the past to identify and fix everything from blue screens (BSOD's), ActiveX errors, corrupt files and processes, dll/exe/sys errors, recover lost memory, Windows update problems, defragging, malware removal etc.

You can download it direct from this link http://downloadreimage.com/download.php. (This link will automatically start a download of Reimage that you can save to your computer.)

A: Very compromised PC

Read other 16 answers
RELEVANCY SCORE 48

Hello.  I seem to be sharing my firewall privileges with a remote hacker and a system restore didn't help.  A similar posting at Tom's Hardware pointed to a corrupted/malware rundll32.exe file creating extraneous malware files (guard.tmp, filename.dll) in his Win/System32 folder.  I suspect I have something similar though couldn't find those same file names.  (His posting is here: http://www.tomshardware.com/forum/134388-45-mysterious-rundll32-administrator-privileges )
 
I have tried kaspersky, combofix, rskiller, hitman, symantec, emsisoft, avg, symantec, windows defender, etc.  I am not a tech guy by trade but serve as my own IT guy some months so any help I get is welcome.  I probably am supposed to be posting "hijack this" findings or something as a first step but haven't done anything like that in 12 years so I figured I would post my problem first.  Thank you.

Read other answers
RELEVANCY SCORE 48

Esteemed Forum Members,

This is my first posting here. I am a Java programmer/developer. And I look forward to participating. Although I generally find that I learn more from reading the posts of the knowledgeable folks here than with me talking.

My current question is to see if anyone knows any more about a computer affliction that has affected two friends in the past week. (They are in different groups, so these are separate "afflictions".)

The two are remarkably similar so I am hypothesizing that they are basically the same attack. I suspect that if I have bumped into two of these cases, you folks may have already been there and done that.

As I don't have access to either of their computers, and as they are rather naive MSWindows users, it might be difficult for me to run the various diagnosic tools on their systems.

Basically the symptom is that they received an email from a known source. (Yeah, I know...) And clicked on a link to one of the {canxhealth health24x medhealthx xmedx } dotcom websites. The result is that, at a minimum, their Yahoo email account was compromised and an email was sent out to all of their contacts. The sent email has no subject and contains only the link to the malware website.

Googling through the web, I see suggestions ranging from changing the email account password through reformatting the hard-drive and resetting external routers. I also see claims that none of the major anti-virus/firewall applications detect this... Read more

A:Yahoo Account Compromised, possible system compromised

Hello Chuck, First i will move you one forum down to Am I Hacked.Please read the first pinned topic there, Who To Contact If Your Yahoo Webmail Account Is Hacked Next follow tese instructions,also a pinned topic there How to receive help in the Am I Hacked? forum

Read other 5 answers
RELEVANCY SCORE 34.4

I attempted to follow the malware prep guide but stalled out on step 7 when DDS would not run. I followed the threads in the forums to download and run RSIT and have posted the logs below. I have also included the inital logs for recent events from Norton Internet Security which keeps flagging and removing local virus and blocking attacks from the internet. Any help is greatly appreciated.My basic problem is that Norton is locating and eliminating a virus every time I boot my pc. Norton also picks up and blocks some internet attacks everytime I attach to the internet. However each time I restart my pc the virus re-appears.thanks!NORTON RECENT SCAN DATA:Category: BackupDate & Time,Severity,Activity,Status,Recommended Action,Action,Location,Media Type5/15/2010 10:00 PM,Info,Backup performed to I:,"Canceled, Canceled",None,Backup,I:,CD/DVD DriveCategory: Firewall - Network and ConnectionsDate & Time,Severity,Activity,Status,Recommended Action,Subnet Identifier,Gateway Physical Address,Category,Gateway IP Address5/15/2010 9:45 PM,Info,Connected to a protected network. (127.0.0.0/255.0.0.0),Protected,No Action Required,127.0.0.0/255.0.0.0,,,5/15/2010 9:45 PM,Info,Connected to a shared network. (00 12 17 C5 E0 D9),Trusted,No Action Required,,00 12 17 C5 E0 D9,,5/15/2010 9:45 PM,Info,"Protecting your connection to a newly detected network on adapter \"Realtek RTL8169/8110 Family Gigabit Ethernet NIC - Packet Scheduler Miniport\" (IP ad... Read more

A:PC has been compromised

Hello and welcome to Bleeping Computer! We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the results.Fo... Read more

Read other 2 answers
RELEVANCY SCORE 34.4

Why am I getting buried here?
 

A:Compromised...but not sure how or how bad...help please

I know I got some bad spyware from somewhere and keep getting all kind of weird notifications from spyware doctor that something has been blocked. Also I get notification that programs could not start at start up. I then run a scan with Spywaredoctor or superantispyware or adaware and it seems to get rid of the problem, but the next time I start up there is a new problem. The most recent one is "TA_start failed to begin correctly at start up" or something such. I feel like I'm killing the weeds but not the root.

I downloaded hijackthis and made a log. Hopefully it has everything needed. Spywaredoctor tried to blaock something it was doing.

Any help you can provide would be super.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:22:55 PM, on 6/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\asuskbservice.exe
C:\WINDOWS\system32\AvidSDMService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Avid\Digidesign\Drivers\MMERefresh.exe
C:\Program Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Nort... Read more

Read other 3 answers
RELEVANCY SCORE 34.4

I have a Sony PC running windows XP. My Zone Alarm firewall blocked iexplorer.exe trying to access the internet to some unknow IP address. I've scanned my system with AVG anti-virus and with spyware from Zone Alarm and Spysweeper but they didn't detect anything. Could I have been compromised?
 

A:Have I been compromised?

Bump
 

Read other 1 answers
RELEVANCY SCORE 34.4

i run trend paid internet security 2010 .. a colleague was hit by gumbar and another by hacktool rootkit ... my machine slowed to a crawl last night, minute between clicks .. but a reboot and i 'seem' to be running normally and have had a clean scan from that, prevx, and malwarebytes, but I'm still paranoid, so I really appreciate any insight into the logs I'm posting per the instructions here http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ (i included hijackthis log too just in case)i'm on a vista 64bit .. and running GMER, i only had services/registry/files / ADS available for selection.. system devices.. etc .. all were grayed out.DDS (Ver_09-12-01.01) - NTFSX64 Run by websitewendy at 11:55:02.28 on Thu 02/18/2010Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_16Microsoft? Windows Vista? Home Premium 6.0.6001.1.1252.1.1033.18.4094.1108 [GMT -8:00]SP: Windows Defender *enabled* (Updated) coloro:red4============== Running Processes ===============C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\svchost.exe -k rpcssC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\SLsvc.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC... Read more

A:have i been compromised ?

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. Please include a clear description of the problems you're having, along with any steps you may have performed so far.Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.We need to create an OTL ReportPlease download OTL from one of the following mirrors:This is THE MirrorSave it to your desktop.Double click on the icon on your desktop.Click the "Scan All Users" checkbox.In the custom scan box paste the following:CODEnetsvcsmsconfigsafebootminimalsafebootnetworkactivexdrivers32%systemroot%�... Read more

Read other 15 answers
RELEVANCY SCORE 34.4

i went to amazon last night, tried to buy a gift card and got the attached warning.  amazon help couldn't tell me why he said everything is up to date. i also noticed my some of my browsers options had changed
 attach.txt   8.68KB
  0 downloads
 
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17207  BrowserJavaVersion: 10.51.2
Run by Bobz at 16:03:58 on 2014-07-16
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.8182.5220 [GMT -7:00]
.
AV: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\sy... Read more

A:compromised ??

Hello and Welcome on board Bobz1x,my Name is Machiavelli and I will assist you with your problem.If you booted into safe mode on your computer then print my instructions!I'm in the 'Malware Staff Team' and will provide you with advice:To remove Malware on a computer can be very complicated. Malware (malicious software) is able to hide and so I may not be able to find it so easily. In order to remove Malware from you Computer, you need to follow my instructions carefully. Don't be worried if you don't know what to do. just ask me! Please stay in contact with me until the problem is fixed.Below are a few tips:Removing Malware is usually very difficult.We need to search and analyse a lot of files. As this is done in our free time, please be patient especially if I don't answer every day!Please follow these instructionsIf you don't follow the instructions your computer may crash. If you fix your PC by yourself, this can be very risky!Please stay in contact with me until your problem is resolvedAs Malware may not be totally removed in one session or in one day, please stay in contact with me until the problem is resolved.Please don't run any other tools without consulting with me as this can complicate finding and removing all MalwareDon't run any tools while I'm fixing your PC. That is counter productive and again, will only complicate finding and removing all Malware!Read my post completelyIf you don't do so, you may make mistakes that could result in your System crashing by you... Read more

Read other 13 answers
RELEVANCY SCORE 34.4

Hey guys, my computers been acting really slow and strange lately. It also has a new user called IUSER_Admin on it.

Here is the log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:41:33 PM, on 10/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\AFinding.exe
C:\WINDOWS\system32\afisicx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\mabidwe.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\macidwe.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOW... Read more

A:HELP i think i have been compromised!

Hello and welcome to TSF

==========
Download RSIT by random/random and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)

============
Logs Required
log.txt
info.txt

If there is no response to this post within 72hrs, this thread will be closed.

Read other 6 answers
RELEVANCY SCORE 34.4

Hoping someone can provide some assistance here.... need system analyzed. Have compiled logs & data for troubleshooting...

Windows XP Home v 2002, SP 3
Intel Celeron 2.4 GHz
2.39 GHz , 256 MB RAM
Hard wired to : Arris Modem #TM502G---->Buffalo High Power AirStation A&G: (NAT enabled & PNP disabled, Intrusion detector enabled, etc... MAC filtered, not broadcasting SSID, etc...) ---->Motorola VT1005 (set statically)---->PC (Broadcom 440x 10/100 Integrated Controller w/TCP/IP set statically, and NetBios disabled)
Agnitum Outpost Firewall Pro ver. 4.0.971.7030 (584): (Stealthed as much as I could without sacrificing connectivity)
Avast! v. 4.8 Home Addition Build Dec. '08 (4.8.1296) : (Stealthed)
ProtoWall : (need to update lists, there are a few certain sites I have to disable ProtoWall to visit...)

Wondering if all my PC issues aren't due to my system being compromised. Have been running extensive scans. Are you familiar with analyzing any of the following logs: DrWeb, FPort, HijackThis, RootkitRevealer, StartDreck, SpyBot S&D?

Strange thing that occured though, right after I started noticing these issues, I received an email from my web host provider, stating that one of my websites had been compromised and my web page had changed, here is what they said:

"Recently, we noticed that your username and password for your ftp account hosting has been used by someone to alter your main index.html (or index.htm, index.php) file for ... Read more

A:Has My PC Been Compromised?

You have done most everything that we can recommend in this particular forum. HJT logs should not be posted hereWe have a revised procedure for HJT that you should read first:http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/Then post the log in the proper forum here:http://www.bleepingcomputer.com/forums/f/22/virus-trojan-spyware-and-malware-removal-logs/

Read other 3 answers
RELEVANCY SCORE 34.4

I received one of these scam "I need money" emails from a friend and immediately realised that her computer had been hacked. I replied telling her so.Now I have received another email from her with a new email address saying that since she was hacked she had been unable to receive anything at the original address, she thinks everything went to the hackers. I am just wondering whether my response to the original email has put me at risk and if so what should I do bout it or is it too late.
Nita
 

A:Am I compromised

Read other 6 answers
RELEVANCY SCORE 34.4

IE is doing weird things like not allowing me to login, not allowing me to get past the first page in the forums of a website I use regularly, going very slow. I tried FF and it seems to work a little better but I get messages that I am sending over unencrypted pages even on TSG. I added a bunch of extensions but I still feel insecure. The NYTimes page comes up but I cannot get any articles to come up when I click them. I can get videos and photos but no articles. I tried FF and now it goes to a login page when I click on an article. It has never been a login sort of page.

The only out of the norm thing I have done is watch some videos of Bettany Hughes Ancient World series. After I was done my machine was slow. So I restarted it and when the desktop was up I saw a window appear that was just the upper right corner of a browser page. There were some letters the _ the box and the X. It did not respond to me clicking on the maximize box or the close X. Then it just disappeared on its own a few seconds later.

I have scanned with Avira free, Defender, and Malwarebytes all of them find nothing but neither of my browsers work properly any longer and I think I am compromised.

Any help?
 

A:I think I am compromised

Read other 16 answers
RELEVANCY SCORE 34.4

Hi there,

Ried in the virus/malware section was previously helping me out. No virus/malware was detected on my system. As a result he referred me to you guys since I am still having problems. My machine started acting up after I installed RealWorld Cursor Editor. The cursor repeatedly froze up for no reason. As a result, I went ahead and uninstalled real world but the issue still continues to persist. In the interest of time, a summary of all the steps he took is posted below:

1. Tried System Restore from both Normal Mode and Windows Recovery Environment and it fails to complete.

4. Mention that issue seems to have begun after installing RealWorld Cursor, and that it had been uninstalled.

3. Reviewed detailed logs for any remnant RealWorld entries and none found.

4. Issue does not occur in Safe Mode.

A:Been Compromised again!

Hi, press the win + r key together, in the run box type:- msconfig, open the services tab and put a check in "hide all microsoft services" look at the remaining services for anything to do with the program, uncheck it and apply, also look under the startup tab anything that looks like it's associated with the program uncheck. If unsure you can still uncheck items (just leave virus and malware programs checked) If you want more info about items google OR post back.

Since that program effects Icon and mouse cursor we should try resetting the default registry settings, this will do no harm. Run the attached .zip file then double click on the returned .reg file allow to be added to registry. Restart computer.

Ico,zip.ZIP

Read other 8 answers
RELEVANCY SCORE 34.4

I had a post in another forum, but after running MBAM(no results). I thought I should post in here. If not, my apologizes, please move me to the correct area. My daughter plugged into a USB port, some cheapo camera she had. I got an error message on my screen(don't recall). I rebooted and now my CPU fan seems like it is about to launch. Any and all advice is appreciated. My 9 year is upset, she thinks she broke it. THANKS!

A:I think my Pc might of been compromised.

Hello is this an XP PC or another? The error message would help if you see it again. Open the Tazk Manager (press CTRL+ALT+DEL). Click on Processes Tab and is something using a lot of your CPU ?Run ATF and SAS:From your regular user account.Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..DO NOT run yet.Open SUPER from icon and install and Update itUnder Scanner Options make sure the following are checked (leave all others unchecked):Close browsers before scanning.Scan for tracking cookies.Terminate memory threats before quarantining.Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.Now reboot into Safe Mode: How to enter safe mode(XP)Using the F8 MethodRestart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Double-click ATF-Cleaner.exe to run the program.Under Main "Select Files to Delete" choose: Select All.Click the Empty Selected button.If you use Firefox or Opera browser click that browser at the top and choose: Select AllClick the Empty Selected button.If you would like to keep your saved password... Read more

Read other 6 answers
RELEVANCY SCORE 34.4

TL;DR I went to the website in this picture (http://puu.sh/pQ2ll/784eb6bbe8.jpg) and downloaded a file disguised as a flash update and executed it repeatedly like a moron. It opened a command prompt with a title I don't remember and closed quickly, nothing has happened since. I don't know what it did or if it's even an active threat.
 
I'll put this at the top for those disinterested in the story, I've run Malwarebytes Anti-Malware to no avail, I ran rkill.com and it interacted with nothing, and after that I did a system restore to a point two days ago. I'm aware system restore is dubious at best for virus and malware removal, but I can't think of anything more appropriate to do for something I doubt would even flag as spyware than simply factory resetting my laptop, which I still might do. It feels as if it's running slower than usual, but it's so barely noticeable that it might just be that I rebooted it for the first time in a while combined with placebo. Might I still be infected?
 
I woke up this morning and popped my laptop open, and within minutes of logging onto Steam, a person on my friends list that sends messages to me sporadically with large gaps in between sent me a link saying he found me in a video on Twitch for a game that I play very often. Being early morning, from a friend that does this often, I clicked the link, but instead of the video playing, the box simply showed the "You must update Adobe Flash Player" notice that looks exactly like it woul... Read more

A:Am I still compromised?

Adware Cleaner Scan.
 
Please download AdwCleaner by Xplode onto your desktop.
Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.
 
JRT Scan.
Please download Junkware Removal Tool and save it on your desktop.
 
Shut down your anti-virus, anti-spyware, and firewall software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Windows 7, right-click it and select Run as administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log is saved to your desktop and will automatically open.
Please post the JRT log.
 
Adware Removal Tool Scan.
 
Download Adware removal tool to your desktop, right click the icon and select Run as Administrator.
 
 

 
Hit Ok.
 

 
Hit next make sure to leave all items checked, for removal.
 

 
 
The Program will close all open programs to complete the removal, so save any work and hit OK. Then hit OK after the removal process is complete, thenOK ... Read more

Read other 1 answers
RELEVANCY SCORE 34.4

Hi,
Once again, I have been forced to ask for help. Allayed by the fact no infections were found on my machine earlier I soon relapsed into complacency. But almost immediately my solace was short-lived. For the past 1 week my computer has been acting up for no apparent reason. Something is horribly wrong with the cursor and application tabs. At times my cursor refuses to do what I want. I keep clicking away at 'x(s)' but application windows just sit there frozen. Instead of closing out, my cursor freezes up. Then yesterday my comp. simply blacked out. A message reading ' Not compatible with windows 64-bit....' mysteriously appeared but on restarting the computer it was gone. Pulling on scroll bars using the cursor is another goof-up. No matter how hard I try, scroll bars refuse to pull up or down. After several tries the picture gives way. I have a penchant for watching youtube videos ( engineering simulations). Is it possible that may be the culprit? Anyhow, I have posted/attached the following logfiles.

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_27
Run by SHAHJEE at 15:19:14 on 2011-11-06
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3894.925 [GMT -8:00]
.
AV: Kaspersky Internet Security *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-D... Read more

A:Been compromised again!

"BUMP, please"

Read other 19 answers
RELEVANCY SCORE 34.4

Need help getting rid of the bad guys

Here is my HJT log


Logfile of HijackThis v1.97.7
Scan saved at 5:12:55 AM, on 7/18/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\WEBSCANX.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\LAUNCHER\CTLAUNCHER.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\CREATIVE\SHAREDLL\AHQ\CTMIX32.EXE
C:\PROGRAM FILES\NETWORK ASSOCIATES\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\PROGRAM FILES\COMMON FILES\ROXIO SHARED\PROJECT SELECTOR\PROJSELECTOR.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\DRAGTODISC\DRGTODSC.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\RXMON.EXE
C:\QUICKENW\QWDLLS.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\PROGRAM FILES\OLYMPUS\CAMEDIA MASTER 4.0\CM_CAMERA.EXE
C:\PROGRAM FILES\ROXIO\EASY CD CREATOR 6\AUDIOCENTRAL\PLAYLIST.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MOTIVE\ASSTCOMMON\MOTIVEDIRECTORY.EXE
C:\PROGRAM FILES\SBC SELF SUPPORT TOOL\BIN\MAD.EXE
C:\PROGRAM FILES\SBC SELF SUPPORT TOOL\BIN\MPBTN.EXE
C:\PROGRAM FILES\SBC SELF SUPPORT TOOL... Read more

Read other answers
RELEVANCY SCORE 34.4

Recently my son went on my pc and clicked a link over discord from someone he didnt know. The file was 011.exe. This in turn gave someone full access of my pc and i want to know what to do and if a factory reset will get rid of this persons connection to my pc
 

Read other answers
RELEVANCY SCORE 34.4

Hi there

My system has been compromised just recently and would like your help on the matter.

Here's what I've done so far: Installed and ran "CCleaner", removed whatever it found. Did the same with "Ad-Aware" and it actually found some trojan of some sort and removed it. Then I intalled "Spybot Search & Destroy" and did a search with that one. And finally I ran a virus check with "NOD32" and topped it off with "MalwareBytes' Anti-Malware". "NOD32" found some trojans in "Java" which I deleted manually and did a new search, where nothing showed up. I've got logs of the Java trojans. So I've updated "Java" now as well, so that hopefully will close any security holes.

So I'll post a log from MBAM and HJT and would really appreciate your opinion on this matter. Are my system okay now, or can you still see something?
Thank you.

Malwarebytes' Anti-Malware 1.44
Database version: 3874
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

16-03-2010 23:58:52
mbam-log-2010-03-16 (23-58-52).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 187944
Time elapsed: 20 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No... Read more

A:Compromised

Hello and welcome to TSF.

HijackThis is no longer the preferred initial analysis tool in this forum.

We want all our members to perform the steps outlined in the link given below, before posting for assistance. There's a sticky at the top of this forum, and a
Quote:




Having problems with spyware and pop-ups? First Steps




link at the top of each page.

Please follow our pre-posting process outlined here:

http://www.techsupportforum.com/f50/...lp-305963.html

After running through all the steps, you shall have a proper set of logs. Please post them in a new topic, as this one shall be closed.

If you have trouble with one of the steps, simply move on to the next one, and make note of it in your reply.

Read other 1 answers
RELEVANCY SCORE 34.4

I Did a Dumb Thing!!!

I got an email message that my ATT Worldnet account had to be updated or my account would be terminated.

Since Cingular recently purchased ATT services, I thought it was legit and part of the transition of services.

I clicked on to the website, which asked for my name, password, address, phone, and credit card number. I typed in the first 4, but hesitated at the credit card line, since I pay by mail.

The site window was set up with "continue" keys. Because I did not give my credit card info, it would not continue to the next sceen. I then closed out th screen using the Windows close icon box in the upper right corner.

I called ATT and found out the website was a fraud!!!

My Question:

Since I closed out everything before reaching the "send" screen, is my name, address, and password still secure, or did that info still reach the scam artists?

I know it was a dumb mistake, but will appeciate any advice about the damage done, and what, if anything, I can do to correct it ( I ran spyware and antivirus check immediately, with no problems reported).

Thanks

adf
 

A:Is my ID compromised?

As long as you did not transmit any data to the website then your information is still secure but just to ease you mind you should go to the official website and change your password.
 

Read other 2 answers
RELEVANCY SCORE 34.4

Hi,My sister downloaded a program thinking it was a utorrent program but it didn't install anything (that she knows about). Its from this page hxxp://onhax.net/utorrent-plus-crack/ Halfway down theres a green direct download link says "Crack and setup. Direct download" The file is "Crack and setup.exe" Step I've taken. I've deleted the file. I've run Adwcleaner This is the result # AdwCleaner v4.102 - Report created 27/11/2014 at 14:11:26# Updated 23/11/2014 by Xplode# Database : 2014-11-26.1 [Live]# Operating System : Windows 8.1  (64 bits)# Username : Evan - ARMYPC# Running from : C:\Users\Evan\Downloads\AdwCleaner.exe# Option : Scan***** [ Services ] ********** [ Files / Folders ] ********** [ Scheduled Tasks ] ********** [ Shortcuts ] ********** [ Registry ] *****Key Found : HKCU\Software\systweakKey Found : [x64] HKCU\Software\systweak***** [ Browsers ] *****-\\ Internet Explorer v11.0.9600.17416-\\ Mozilla Firefox v33.1 (x86 en-US)*************************AdwCleaner[R0].txt - [659 octets] - [27/11/2014 14:11:26]########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [718 octets] ##########   And I've run JRT.exe and tdsskiller.exe They found nothing..  So I'm thinking maybe the file just affected some registry tweaks. Thanks for your help. I just want to be sure that theres nothing suspicious on my harddrive. I am using Windows 8.1, its fully updated. Evan.Mod Edit by quietman7: D... Read more

A:Not sure if I've been compromised

Hello there  
 
I'm LighthouseParty and I'll be assisting you with your concern today. Please keep in mind that I have a few guidelines I need you to follow:
Don't run any other tools other than what I provide you with.
Don't install/remove any programs other than what I provide you with.
Don't perform a system restore unless I ask you to.
 Download MiniToolBox
Click here to download MiniToolBox to your desktop.
Double click MiniToolBox.
Select the following and then press go.
Post the log in your next reply.
Flush DNS
Reset IE Proxy Settings
Reset FF Proxy Settings
List Installed Programs
List Restore Points
 
 Install and run a scan with Malwarebytes Anti-Malware
Click here to download Malwarebytes to your desktop.
Double click mbam-setup-x.x.x.xxxx and follow the on-screen instructions.
On the dashboard, click update now.
After that, click scan now - the scan will now begin.
When the scan's completed, select apply actions - make sure the action is quarantine.
Restart your computer.
How to get the log.
On the dashboard, select the history tab and click application logs.
Select the log which has the time and date of when you did the scan.
Click copy to clipboard and paste it into your reply.
 Download Security Check
Click here to download Security Check to your desktop.
Double click SecurityCheck and follow the on-screen instructions.
A log should open, called checkup.txt.
Please post... Read more

Read other 4 answers
RELEVANCY SCORE 34.4

i went to amazon last night, tried to buy a gift card and got the attached warning.  amazon help couldn't tell me why he said everything is up to date. i also noticed my some of my browsers options had changed .

A:compromised ??

Possibly, but we should get a deeper look as financials are involved. Please follow this Preparation Guide, do steps 6,7 and 8 and post in a new topic.Let me know if all went well.

Read other 9 answers
RELEVANCY SCORE 34.4

Hi,

For the past 3 days my computer has been acting up for no apparent reason. Something is horribly wrong with the system volume. Each time I hit the volume button the bar increases/decreases asynchronously. In other words, the volume continues to increase/decrease long after the f10/f9 buttons have been released. If this weren't enough windows seem to open and close by themselves without warning. In addition, while typing, parts of paragraphs magically highlight themselves and then erase at will in the midst of completing an entire sentence. Since the system can be recovered at anytime, I did not take the trouble of compiling a boot cd. It looks like I've been compromised! Any help is much appreciated. In compliance with the wishes of the moderator I have posted/attached the following logfiles.
.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 8.0.7601.17514 BrowserJavaVersion: 1.6.0_27
Run by SHAHJEE at 15:19:14 on 2011-11-06
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3894.925 [GMT -8:00]
.
AV: Kaspersky Internet Security *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Enabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\... Read more

A:Been Compromised!

Hello and welcome back to TSF Virus & Malware support. My name is Taylor and I'll be helping you with your fix.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

You may wish to subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

Please be patient with me during this time.

Read other 4 answers
RELEVANCY SCORE 34

Hi am i infected? Today i got an email on my blackberry that my PayPal was used unauthorized i want to make sure it wasn't from a virus or anything that could compromised my security . I have called PayPal and currently getting the problem fixed. I have AVG Internet Security 9.0 and Malwarebytes 1.44 installed and they do run on a scheduled bases with no infections found. Malwarebytes keeps blocking ips but im think its programs trying to access my computer but not to sure. So to be on the safe side im here asking for help to find out if im infected in some other way?

A:PayPal Compromised

Sorry mods can you plz move this to the Am I infected? What do I do? section didnt mean to post it here

Read other 1 answers
RELEVANCY SCORE 34

Hi there

I have a Server running 2003, which at this moment is seriously compromised....it is running apps really slow. I would normally just re-format the drives and start from scratch..but there is critical info on this server which is needed and moved and possibly cleansed before putting onto a new server

I have attached a HJ Log for your perusal
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:52:18, on 30/06/2010
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\CA\SharedComponents\Alert\ALERT.EXE
C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\ARCserve Backup\DBENG.exe
C:\Program Files\CA\SharedComponents\ARCserve Backup\CADS\casdscsvc.exe
C:\Program Files\CA\ARCserve Backup\jobeng.exe
C:\Program Files\CA\ARCserve Backup\msgeng.exe
C:\Program Files\CA\ARCserve Backup\MgmtSvc\casmgmtsvc.exe
C:\Program Files\CA\SharedComponents\ARCserve Backup\ASPortMapper\Catirpc.... Read more

A:Compromised Server Anyone Help???

Hi there

Updated log after I noticed the log was a day or two old
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 17:26:09, on 05/07/2010
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v7.00 (7.00.6000.17055)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\CA\SharedComponents\Alert\ALERT.EXE
C:\PROGRA~1\APC\POWERC~1\agent\pbeagent.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\ARCserve Backup\DBENG.exe
C:\Program Files\CA\SharedComponents\ARCserve Backup\CADS\casdscsvc.exe
C:\Program Files\CA\ARCserve Backup\jobeng.exe
C:\Program Files\CA\ARCserve Backup\msgeng.exe
C:\Program Files\CA\ARCserve Backup\MgmtSvc\casmgmtsvc.exe
C:\Program Files\CA\SharedComponents\ARCserve Backup\ASPortMapper\Catirpc.exe
C:\Program Files\CA\ARCserve Backup\caserved.exe
C:\Program Files\CA\SharedComponents\Jre\1.4.2_16\bin\java.exe
C:\Program ... Read more

Read other 2 answers
RELEVANCY SCORE 34

Dear Tech Support guy,

Recently I had suspections of an keylogger on my system since every site I run had the same problem.
It had a code pasted in every php and js file and that code disables javascript on the website.

It could be several computers but I'm cleaning my main PC first.

I did an Avira scan and it seemed clean, but the infection got back.

One other thing I just noticed is that my "g" button doesn't work when I'm typing in this field. It does work in other programs. No idea if it has anything to do with the infection.
------------------
System Information
------------------
Operating System: Windows XP Professional (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.090804-1435)
Language: Dutch (Regional Setting: Dutch)
BIOS: BIOS Date: 01/30/08 10:01:36 Ver: 08.00.10
Processor: Intel(R) Core(TM)2 Duo CPU E7200 @ 2.53GHz (2 CPUs)
Memory: 3072MB RAM
DirectX Version: DirectX 9.0c (4.09.0000.0904)
---------------
Display Devices
---------------
Card name: NVIDIA GeForce 8500 GT
Manufacturer: NVIDIA
Chip type: GeForce 8500 GT
DAC type: Integrated RAMDAC
Device Key: Enum\PCI\VEN_10DE&DEV_0421&SUBSYS_82771043&REV_A1
Display Memory: 512.0 MBClick to expand...

My HijackThis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:23:10, on 28-12-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\sys... Read more

Read other answers
RELEVANCY SCORE 34

so i get home from work yesterday , logon to my laptop so i can do my uni homework and i see all these weird links on the desktop... you porn, all sorts of other porn sites which i never use..

i immediately knew it was a bug so I attempted to download malwarebytes and others, but I cannot go to any malware combat site..

i did finally manage to install malwarebytes but cant update it..

thats the jist of it...cannot go to any av or malware sites.
HJT LOG:

-------------------------------------------------------------------

please help!Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:43 AM, on 1/4/2010
Platform: Windows XP SP3, v.3311 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TrojanHunter 5.2\THGuard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Cpqdiag\Cpqdfwag.exe
C:\Program Files\Genex Audio\GXHostService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\H... Read more

Read other answers
RELEVANCY SCORE 34

So my dad tells me that his desktop computer is acting all weird, and I have a feeling something may be infected. Internet Explorer.exe cannot be found, I think it was deleted or renamed, which raises alot of questions as to how that happened. Here is my Hijack This Log File... Thank you !
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:29:49 PM, on 2/14/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell Network Assistant\hnm_svc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Google\Google Desktop Search\Goo... Read more

A:Computer compromised

Read other 9 answers
RELEVANCY SCORE 34

Friends laptop....
Somehow his e mail([email protected]) list got accessed
Now EVERYONE on his list gets spam e mails
Had a TECHIE checkout the laptop...couldn't find ANY viruses
Then said he has heard of a "GHOST VIRUS"???
IIRC said friend is running Widows 7 with VIROZON WIRELESS with the card
Anyone ever heard of a GHOST VIRUS ???One that doesn't show up on the machine

A:E MAIL COMPROMISED

Not sure what a "ghost virus" means but it could be some kind of FUD program that may not be detectable initially.

It is also possible that someone else knows his password or was able to successfully revert into his email account.

Read other 4 answers
RELEVANCY SCORE 34

Been fighting this for a week and I can't find anything actually wrong, but I know something has to be there. My Warcraft account was recently hacked and based on some of the actions of the hacker I have to assume that they have gained access to my computer. Not only have they gotten my login information everytime I change it, but they have gotten some files submitted to Blizzard. Despite running multiple virus and malware scans nothing has ever come up. I am reluctant to simply reformat because I would like to at least try to understand how this has occured, but you can't fix what you can't find.
 
 
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16750  BrowserJavaVersion: 10.45.2
Run by troy at 1:30:21 on 2014-01-14
Microsoft Windows 7 Professional   6.1.7601.1.1252.1.1033.18.4094.1950 [GMT -6:00]
.
AV: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Emsisoft Anti-Malware *Disabled/Updated* {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Emsisoft Anti-Malware *Disabled/Updated* {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
SP: AVG AntiVirus Free Edition 2014 *Enabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
C:\Windows\system32\svc... Read more

A:Computer Compromised

Hello and welcome to Bleeping Computer! I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.
We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.
To help Bleeping Computer better assist you please perform the following steps:
*************************************************** In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/520819 <<< CLICK THIS LINK
If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.
***************************************************If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of t... Read more

Read other 17 answers
RELEVANCY SCORE 34

I have a malware program hijacking my email. It sends spam out to all of my email contacts on hotmail. Here is my hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:00:30 AM, on 12/9/2009
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
c:\PROGRA~2\mcafee.com\agent\mcagent.exe
C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files (x86)\Adobe\Adobe Acrobat 7.0\Distillr\acrotray.exe
C:\Program Files (x86)\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files (x86)\Input Director\InputDirector.exe
C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files (x86)\Java\jre6\bin\jusched.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files (x86)\Internet Explorer\IELowutil.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.micr... Read more

Read other answers
RELEVANCY SCORE 34

I had my world of warcrat account stolen. I have run all the security / cleaner programmes and this is the log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:18, on 26/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SMINST\Scheduler.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifSvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.e... Read more

Read other answers
RELEVANCY SCORE 34

Hi

My system has been compromised just recently, so I've used different software to scan my drives and they found something and removed it.

Now I've followed your instructions and have used dds and gmer (sorry for that post before ). So I would appreciate if you looked through my logs and told me if you see something suspecious.

Thank you.


DDS (Ver_10-03-17.01) - NTFSx86
Run by Hense at 16:00:15,18 on 18-03-2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.45.1033.18.3071.2407 [GMT 1:00]

AV: ESET NOD32 antivirus system 2.70 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
svchost.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\NVI... Read more

A:My system has been compromised

Howdy there and welcome to TSF Forums

I'm Steve and I will be helping you thoughout this fix.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. It is IMPORTANT that you don't miss a step. Please perform everything in the correct order/sequence.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription

Please note that the forum is very busy and if I don't hear from you within three days from this initial post then thread will be closed.

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Please download DeFogger to your desktop.

Double click DeFogger to run the tool. The application window will appear
Click the Disable button to disable your CD Emulation drivers.
Click Yes to continue
A 'Finished!' message will appear
Click OK
DeFogger will now ask to reboot the machine - click OK
IMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_disable which will appear on your desktop.

Do not re-enable these drivers until otherwise instructed.

Please rescan with GMER

Double cl... Read more

Read other 10 answers
RELEVANCY SCORE 34

I recently left my computer unattended (6-Jun) and for some reason the system did not lock after the first few minutes of inactivity. I have reason to believe my machine may have been tampered with. I'm concerned a keylogger may have been installed. Not sure that's what it's called but basically spyware that reports back to someone what's being done on a computer. A colleague's crazy ex did something like this to her.

Not to sound like a patient in a doctor's office with a vague symptom like fatigue but my laptop is running very slow and always seems to be chugging away at something (sounds like it's continually accessing the hard drive).

Many thanks in advance for any help you can offer ... it will help me sleep at night! Following is the log from DDS and attached are the logs from DDS and GMER.

DDS (Ver_09-05-14.01) - NTFSx86
Run by Owner at 16:17:03.73 on Thu 06/11/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.214 [GMT -4:00]

AV: Trend Micro Internet Security *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
FW: Trend Micro Personal Firewall *enabled* {3E790E9E-6A5D-4303-A7F9-185EC20F3EB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C... Read more

A:Security Compromised

Hello timetraveller61,

I'm not seeing any malware in your logs, let's see if an online scan reveals anything. It can take some time, so please be patient and allow it to run it's full course:


Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/par...avwebscan.html

1. Click Accept, when prompted to download and install the program files and database of malware definitions.


2. To optimize scanning time and produce a more sensible report for review:Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.



Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Read other 10 answers
RELEVANCY SCORE 34

Hey TSF,

I got an e-mail today stating that my Valve Steam Account had the email address and password changed without my consent. I'm mildly worried that the problem is on my computer at college rather than at home, and I'm unsure if I have a keylogger or trojan or other such malware. My school mandates the use of Windows Defender and Symantic Antivirus; I keep spybot running, and I run Malwarebyte's every once in a while. Please let me know if I have something to worry about.

Logs are attached, and I'm now at your mercy.

DDS (Ver_09-02-01.01) - NTFSx86
Run by KRUG_JONA at 22:36:02.70 on Tue 03/03/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_01
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2014.853 [GMT -5:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\... Read more

A:Possibly compromised?

Bump, please

Read other 10 answers
RELEVANCY SCORE 34

Whenever i use my this PC. My Wow account is getting compromised. Please help me are there any keyloggers or trojans in my system can you please take a look

Here is my HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:41:16, on 14.06.2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\VM_STI.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorService.exe
C:\PROGRA~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\... Read more

Read other answers
RELEVANCY SCORE 34

I've been on the phone off and on with the Symantec folks for hours, and I'm fed up and frustrated.

The virus definitions won't update---installation fails. The techs know, we've re-installed 3 times, 3 different ways.. and it still fails.

Anyone else ever have this problem? The techs don't seem concerned that it's a virus, etc. that may have caused the problem. And I do an online virus scan occasionally just to be sure.

I'm using Norton Internet Security 2006 with Windows XP. We bought Norton about a month or two ago, so it's not like we can take it back.

I'm just stumped as to what to do. I can't spend my entire life on the phone with these people, and I thought maybe---just maybe---you guys might have an idea for me.

Thanks.
 

A:Norton compromised?

Read other 9 answers
RELEVANCY SCORE 34

Hello first time here im not sure if im infected but have had trouble installing updates and validating windows i ran farbars tool and it points to registry keys that have no file and require attention i have deleted those keys but they just re-appear i wonder if  someone could look at the logs and advise me
                                        thanks Graeme

A:I think my laptops been compromised

Hello, Welcome to BleepingComputer.I'm nasdaq and will be helping you.If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.===Press the windows key + r on your keyboard at the same time. This will open the RUN BOX.Type Notepad and and click the OK key.Please copy the entire contents of the code box below to the a new file. start
CreateRestorePoint:
EmptyTemp:
CloseProcesses:

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3518170916-4175138910-237300894-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
SearchScopes: HKLM-x32 -> DefaultScope value is missing
CHR Extension: (Google Wallet) - C:\Users\pc\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-24]
CHR HKLM-x32\...\Chrome\Extension: [aeihoglbpfedbnjbinigheaelfnlhlni] - C:\Program Files (x86)\MediaViewerV1\MediaViewerV1alpha1308\ch\MediaViewerV1alpha1308.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [kboiegcaohjmgmjeggcopjchdhhckcco] - C:\Program Files (x86)\MediaViewV1\MediaViewV1alpha2725\ch\MediaViewV1alpha2725.crx <not found&... Read more

Read other 8 answers
RELEVANCY SCORE 34

Hello experts.

My account has been compromised and I've think I've managed to clean my computer. I ran malwarebyte's anti malware and it found 5 trojans. Ad-aware and spybot nor Eset found anything (except a few tracking cookies).

This is the log file from malware is as follows after the cleanup job (its in norwegian and if you need a translation let me know, but I think you guys have seen these logs before :

Malwarebytes' Anti-Malware 1.45
www.malwarebytes.org

Databaseversjon: 3976

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18904

11.04.2010 16:59:41
mbam-log-2010-04-11 (16-59-41).txt

Skanntype: Full skann (C:\|D:\|)
Objekter skannet: 346256
Tid tilbakelagt: 2 time(r), 1 minutt(er), 49 sekund(er)

Minneprosesser infisert: 0
Minnemoduler infisert: 0
Registernøkler infisert: 4
Registerverdier infisert: 0
Registerfiler infisert: 0
Mapper infisert: 0
Filer infisert 1

Minneprosesser infisert:
(Ingen skadelige objekter funnet)

Minnemoduler infisert:
(Ingen skadelige objekter funnet)

Registernøkler infisert:
HKEY_CURRENT_USER\Software\Rabsterman (Trojan.Pasta) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\RunhomemanB (Trojan.Pasta) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\RunhomemanC (Trojan.Pasta) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\RunhomemanD (Trojan.Pasta) -> Quarantined and deleted successfully.

Registerverdier infisert:
(Ingen skadelige ... Read more

Read other answers
RELEVANCY SCORE 34

I downloaded a few songs from LimeWire last night. Two of them did not play music and I was suspicious of them, so I deleted them. Then I ran stinger and it isolated one of the files as being a UA trojan dopwnloader and it said it deleted it. I searched the computer for the other file name and it did not come up. Ok, now today, I opened a My Docs folder and I notcied every folder in there is "Date Accessed" on 3/1/2009 at 8:58 pm. Also a bunch of files are listed as date accessed this morning and afternoon. Some info in those files is sensitive. Is my computer security compromised?
 

A:Is my computer compromised?

Read other 16 answers
RELEVANCY SCORE 34

Hi all,

My brother-in-law's computer is so compromised that you can't even keep it powered on. He runs XP...not the home version. He has a cable modem and no firewall. When he clicks on his username, it logs him on and then shuts him down right away. I'd love to have him run a HijackThis log and post it here, but if he can't even power up, what can he do? I'm posting for him since he can't get on. Any advice?
 

A:Majorly Compromised!

Read other 9 answers
RELEVANCY SCORE 34

Hi,
The past couple of weeks I've kept getting my accounts accessed by other people and I'm unable to find the source. It originally started when my Diablo III account got compromised, and I had to get that account restored. Then just recently I'm receiving messages saying someone in South Korea is accessing my gmail, so I'm worried now that there is some sort of trojan keylogger on my computer. I've tried a decent amount of normal programs in order to try and detect something and remove it, but to no success. Microsoft Security Essentials, Malwarebytes, and a bootable offline version of Windows Defender all found nothing... but my accounts are still being accessed and compromised. I'd just like to try and remove whatever it is without reformatting. I've been changing my passwords every couple of days since this started happening, and some of my accounts are still getting compromised.

Also, unfortunately I've already run Combofix before consulting this forum, simply because while telling a friend of my plight, he recommended using it and I didn't really bother to read the instructions, just brainlessly downloaded and ran it. If you need me to post that log too I can.

EDIT: I also wanted to note that my CD/DVD isn't working/isn't detected by Windows, and it take an abnormal amount of time for my motherboard to go through the post/bios screens upon booting. I have a SSD so usually cold boot to desktop is typically less than 10 secon... Read more

A:Accounts keep getting compromised

Greetings capozide and to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary. If you prefer I call you something other than your screen name I would be pleased to do so.===================================================Ground Rules:First, I would also like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance. Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.Please copy and paste all logs into your post unless directed otherwise.... Read more

Read other 19 answers
RELEVANCY SCORE 34

hi,Kindly have a look at my log file....I'm just going to get crazy...... All of my folders starting with "Microsoft" are hidden.Logfile of HijackThis v1.99.1Scan saved at 10:06:02 PM, on 7/31/2006Platform: Windows 2003 SP1 (WinNT 5.02.3790)MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\System32\bmss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Microsoft ADS\bin\saagent.exeD:\Apache\Apache2\bin\Apache.exeC:\WINDOWS\system32\cisvc.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\WINDOWS\System32\dns.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Merak\calendar.exeD:\Apache\Apache2\bin\Apache.exeC:\Program Files\Merak\control.exeC:\Program Files\Merak\im.exeC:\Program Files\Merak\pop3.exeC:\Program File... Read more

A:Server Compromised

anyone there to help me ???

Read other 6 answers
RELEVANCY SCORE 34

Hi ,after a few weeks of scrabbling around sorting out a few perceived sceurity issues with email etc - yesterday I belive I uncovered a big problem and need help please.Hopefully I'm writing this from a clean machine as I beleive both desktops at home are compromised.Main PC runs XP and has connectivity via ethernet cable via A bt Home Hub2. Other PC's run through wireless connections off this. Yetsrday whilst looking at my network connections I noticed something called "Internet GATEWAY" above my LAN icon.It showed that I had been connected for over 2 days(just over 2 hours for LAN) even when PC turned off and was sending /receiving lots of packets and seemed much faster than my LAN. problem: I click on this & it wont let me disconnect or look at properties / settings - I get a warning to say "connection is currently busy"..............I'm really concerned that this is someone else on my PC - can this be right? how do I resolve it? and is this a matter for the Police?. Surely if its my connection I should be able to view details & edit? I really am concerned.Other symptoms I have noticed - my windows log on "sound" has dissapraed & in event manager - there are no security logs - only one since 2006. PC very slow. Have run SuperAntispyware - no issues having removed a disable security centre option a few days ago. Also malwarbytes found no issues. But I remain convinced something is not right. Really gratfeul for ... Read more

A:compromised connections

FWIW: My Internet Gateway is my router.

Sometimes it's reflected on a system...sometimes not...if I had to guess, I'd say that it depends on how the connection wss established or on the motherboard. I have 2 systems...one reflects it, one doesn't. Should be viewed under Control Panel/Network Connections.

Louis

Read other 5 answers
RELEVANCY SCORE 34

edit: sorry for not posting the malware name in title its JPGIFRAMERi feel that some kind of malware has recently compromised my computer. symptoms:random internet dropslow computermcafee randomly repairing jpg files from the virus JPGiframerbeen a logn time since i got a windows updateheres an HJT log. halp me!!!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 8:36:23 PM, on 5/6/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Creative\Shared Files\CTAudSvc.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exec:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exec:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\WINDOWS\system32\nvsvc32.exeC:\PROGRA~1\McAfee\VIRUSS~1&... Read more

A:Compromised computer

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine. If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine. Please perform the following scan:Download DDS by sUBs from one of the following links. Save it to your desktop.DDS.comDDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool. No input is needed, the scan is running.Notepad will open with the resul... Read more

Read other 2 answers
RELEVANCY SCORE 34

Not sure what's going on, computer recently super slow, pages hang. Sometimes I can move the curser, but the keyboard won't work. Occasionally browser page gets redirected, but not always. When this does happen I always get a popup asking if I'm sure I want to leave the (unwanted) page.
I've downloaded and run several removal programs, ( Malwarebytes, spybot, and superantispyware)as well as scanning with microsoft security essentials.
All programs find issues and ask if I want to remove them.( Which I awnser yes to. )They seem to remove offending entities and I always reboot afterward.
However problems still exist and when I run another scan to check, same nasty bugs show up. funmoods specifically is always found in registry and I cant seem to remove it.
Any help you can offer would be sincerely appreciated.
Thanks!

A:registry compromised?

DownloadTDSSkillerLaunch it.Click on change parameters-Select TDLFS file systemClick on "Scan".Please post the LOG report(log file should be in your C drive) Do not change the default options on scan resultsDownloadaswMBRLaunch it, allow it to download latest Avast! virus definitionsClick the "Scan" button to start scan.After scan finishes,click on Save logPost the log results here.If you get crashes in normal mode,run it in safemode with networkingDownloadESET online scannerInstall itClick on START,it should download the virus definitionsWhen scan gets completed,click on LIST of found threatsExport the list to desktop,copy the contents of the text file in your reply

Read other 7 answers