suspected malware problem

goneracing
goneracing Posts: 49 Forumite
First Post First Anniversary Combo Breaker
in Techie Stuff
My PC has developed a problem after either myself or my daughter used it yesterday.

It’s an intel core duo, 2.4, 4meg ram and running 32 bit Win 7 Home premium and IE 8

Problems are:

1. Hard drive running constantly
2. Noticed this in google. When you klick a link after a search it often opens a random page or it opens a new window displaying a random page. This new page / window has often been “M3 Mirago” or “Ebay” but also others.
3. When you genuinely open ebay to log in
a. A user name is already displayed as symbols / random characters in the log in box and on the top line where it says “Hi user name (sign out)”
b. If you remove the symbols and try to log in it throws an error saying “cookies for this site not enabled” and to review your security settings or log out and back in.
c. clicking sign out does not sign out of whatever account it’s in.

  • “Net Meter” indicates that I’m having more internet traffic than normal
  • using “TCP view” shows many more entries than I usually see and under the processes column shows a lot that are “non existent” along with many more iexplorer entries than usual.

If I pull the network cable that PC does calm down.
My AV is up to date
A quick scan using Malware bytes sorted a couple of minor probs but nothing really. I’m currently running a full scan.

My other PC is working fine

Can anybody give me any pointers please?

Thanks
«13

Comments

  • andy2004
    andy2004 Posts: 1,309 Forumite
    edited 23 February 2013 at 6:11PM
    did you create a backup image before your daughter used your computer.
    It’s an intel core duo, 2.4, 4meg ram and running 32 bit Win 7 Home premium and IE 8
    i think you mean 4gb as 4mb wouldnt run windows 95. windows xp required a minimum of 256mb.

     what "minor probs" did malwarebytes show?
    read the log file, and do a search of what it found.

    There are 3 portable antivirus tools I would suggest.

    Cureit by Dr web, freeware http://www.freedrweb.com/cureit/?lng=en

    Kaspersky portable, http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/avptool11/ choose the one with the newest date.
    Eset online scan. http://www.eset.com/us/online-scanner-popup/ if you use IE otherwise use this link
    for alternate browsers use this link http://download.eset.com/special/eos...taller_enu.exe

    you could use all 3 if you wanted to.

    I've used all 3 over the years, just used eset online the other day before backing up.

    other options.

    Autoruns to see whats running you can disable by removing a tick and rebooting, put tick back enables like MSconfig but you dont get that annoying window. NOTE: you need to know which programs do what.
    http://technet.microsoft.com/en-gb/sysinternals/bb963902.aspx

    http://technet.microsoft.com/en-gb/sysinternals/bb795533 both autoruns and processexplorer can be found on this link
    ProcessExplorer or Processhacker more info given that the task manager.
    you could find processes running you dont know.

    processhacker http://processhacker.sourceforge.net/

    did she install any software / games / toolbars on the pc
    if possible could you paste the quick malwarebytes log file.

    googling M3 Mirago tells me they are an ad company so probably adware installed.
    Whilst your antivirus is upto date you didnt say which one you use.
    but the 3 i mention will work side by side with the installed one.
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    I meant to say 4gig.

    didn't do an image before daughter used it

    I'm using AVG free anti virus.

    malwarebytes found something in the recycle bin

    s-1-5-21-652368235-816347991-2261532960-1000\$R77xrma.zip but removed it.

    have downloaded autoruns and process explorer so will have a look at them for now
  • closed
    closed Posts: 10,886 Forumite
    post a hijackthis log

    disable browser addons.
    !!
    > . !!!! ----> .
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    trying to do a HijackThis scan but it stops partway through as "your system denied write access to the hosts file".
    pressed ok to continue it does a scan and displays it but wont save the log file.
  • closed
    closed Posts: 10,886 Forumite
    see the speedup sticky thread above for a workaround
    !!
    > . !!!! ----> .
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 18:56:01, on 23/02/2013
    Platform: Windows 7 (WinNT 6.00.3504)
    MSIE: Internet Explorer v8.00 (8.00.7600.16869)
    Boot mode: Normal
    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Program Files\AVG Secure Search\vprot.exe
    C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
    C:\Windows\system32\taskhost.exe
    C:\Program Files\Ask.com\Updater\Updater.exe
    C:\Program Files\AVG\AVG2013\avgui.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe
    C:\Program Files\Epson Software\Event Manager\EEventManager.exe
    C:\Program Files\NetMeter\NetMeter.exe
    C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.mg.bt.mail.yahoo.com/neo/launch?.partner=bt-1&.rand=bh6rf20g3g0rk
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (file missing)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
    O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
    O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
    O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
    O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
    O3 - Toolbar: BT Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (file missing)
    O3 - Toolbar: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
    O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
    O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
    O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"
    O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe"
    O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
    O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
    O4 - HKCU\..\Run: [EADM] "C:\Program Files\Origin\Origin.exe" -AutoStart
    O4 - HKCU\..\Run: [KiesHelper] C:\Program Files\Samsung\Kies\KiesHelper.exe /s
    O4 - HKCU\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
    O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
    O4 - HKCU\..\Run: [Update]
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office14\EXCEL.EXE/3000
    O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing)
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (file missing)
    O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
    O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\570\G2AWinLogon.dll
    O23 - Service: ABBYY FineReader 9.0 Sprint Licensing Service (ABBYY.Licensing.FineReader.Sprint.9.0) - ABBYY - C:\Program Files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
    O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
    O23 - Service: Autodata Limited License Service - Unknown owner - C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
    O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe
    O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
    O23 - Service: BitComet Disk Boost Service (BITCOMET_HELPER_SERVICE) - www.BitComet.com - C:\Program Files\BitComet\tools\BitCometService.exe
    O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
    O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\570\g2aservice.exe
    O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
    O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: vToolbarUpdater14.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
  • closed
    closed Posts: 10,886 Forumite
    edited 23 February 2013 at 8:24PM
    which browser are you using?

    try running ccleaner to wipe out your cookies and web passwords

    uninstall toolbars, yahoo, bitcomet, ask toolbar

    might run better with avast free instead of avg.

    Are you still getting web redirects?

    disable these from startup using msconfig

    O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [NeroCheck] C:\Windows\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [KiesTrayAgent] C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
    O4 - HKLM\..\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe"

    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe"
    O4 - HKLM\..\Run: [EEventManager] "C:\Program Files\Epson Software\Event Manager\EEventManager.exe"
    O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
    O4 - HKCU\..\Run: [EADM] "C:\Program Files\Origin\Origin.exe" -AutoStart

    O4 - HKCU\..\Run: [KiesPDLR] C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDL R.exe
    O4 - HKCU\..\Run: [Update]


    they can be run manually if required or reinstated once your problem is solved

    uninstall citrix gotoassist and nokia device unless you use it.
    !!
    > . !!!! ----> .
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    I am using Internet Explorer 8.

    Ok. i have either disabled or uninstalled the above but have kept NetMeter as i have been using it for years and like it as a monitoring tool.

    The hard drive seems to be back to normal and the network traffic monitored by NetMeter is what i would call back to normal i.e. about 2kb/s and if it goes above that i've got an explanation e.g. loaded a new page or whatever.

    I have also removed AVG, installed avast and run Ccleaner.

    But the Ebay page still has a problem. I have removed all my shortcuts to Ebay and navigate to it via a search engine and find the user name box empty. I enter my log on details which opens the page but the name at the top is in symbols eg
    Hi, ��������! (Sign out)

    any subsequent return to ebay has the symbols.

    If i run ccleaner again the first time i open ebay the name is clear.
  • closed
    closed Posts: 10,886 Forumite
    edited 23 February 2013 at 9:43PM
    you could try setting IE to defaults under tools, internet options, advanced, and/or try a different browser http://portableapps.com/apps/internet/firefox_portable

    it could also be an ebay or font problem

    avast has a traffic monitor built in, and some routers can monitor traffic better if you have more than one machine http://vwlowen.co.uk/internet/files.htm
    !!
    > . !!!! ----> .
  • goneracing
    goneracing Posts: 49 Forumite
    First Post First Anniversary Combo Breaker
    reset IE8 to defaults. Ebay page still the same.

    set a restore point.

    Installed IE9.

    when next opening the ebay logon page avast detected and blocked a malicious URL in the ****\internet explorer\iexplore.exe process

    Decided to restore back to IE8 but there are no restore points saved despite checking before i updated IE!!!!!
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

Categories

  • All Categories
  • 343.1K Banking & Borrowing
  • 250.1K Reduce Debt & Boost Income
  • 449.7K Spending & Discounts
  • 235.2K Work, Benefits & Business
  • 607.8K Mortgages, Homes & Bills
  • 173K Life & Family
  • 247.8K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 15.9K Discuss & Feedback
  • 15.1K Coronavirus Support Boards