Think I May Have A Virus

Fergie76

As the title says, I think I may have a virus. Accidentally, clicked on a dodgy email, that took me to a dodgy site.

Never noticed anything to begin with as laptop seems to be running fine.

The only indication that I have that something is not right, is when I try to use the built-in webcam, it says it's being used by another even though I know it's not. Secondly, when I went to try and do a system restore, all my restore points have been deleted and last the dodgy website. Other than that every thing seems to be normal.

I have avast free anti-virus, which is usually good, done a full system scan and it found nothing. I have also done an online scan with Trendmicro Homecall and again nothing.

I also done a quick scan with Malware-bytes, which found 8 thinks which were all quarantined and deleted, but still got same problem?

Any advice would be grateful. Is it worth posting a hijack this log?

Cheers.

closed

reboot, see if the camera works

lack of restore points is common, but what does "and last the dodgy website" mean?

post malwarebytes log

Fergie76

I have rebooted and it still doesn't work. I have stopped all start-up programmes except anti-virus and services, except, windows and anti-virus. Rebooted still not working.

Camera was working fine last week, and the only think I have done was click on that website, so that was the only thing I could think of that was different.

It was a spam email, I should have know better, but I'm a nosey bast.... lol

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.10.10.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
XXXXX:: XXXXX-PC [administrator]

10/10/2013 18:27:10
mbam-log-2013-10-10 (18-27-10).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 251453
Time elapsed: 16 minute(s), 25 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 5
C:\Users\XXXXX\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\XXXXX\AppData\Roaming\OpenCandy\8C6F6A35BBB34B3B97399D4E984CCE39 (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\XXXXX\AppData\Roaming\OpenCandy\OpenCandy_8C6F6A35BBB34B3B97399D4E984CCE39 (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\XXXXX\AppData\Local\Temp\CT3072253 (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.
C:\Users\XXXXX\AppData\Local\Temp\CT3072253\xpi (PUP.Optional.Conduit.A) -> Quarantined and deleted successfully.

Files Detected: 3
C:\Users\XXXXX\Downloads\cbsidlm-tr1_15-USB_Vibration_Gamepad-ORG-161079.exe (PUP.Optional.InstallBrain.A) -> Quarantined and deleted successfully.
C:\Users\XXXXX\Downloads\Express_Installer.exe (PUP.Optional.iBryte) -> Quarantined and deleted successfully.
C:\Users\XXXXX\AppData\Roaming\OpenCandy\8C6F6A35BBB34B3B97399D4E984CCE39\SymantecRegMech_p1v1.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.

(end)

closed

which program is reporting the camera is in use, if it has a light, is it on? Do you have an alternative camera program to test with.

post a hijackthis log

does the camera device appear to be working in device manager, has the machine had more than one camera device installed?

if you want a third opinion about infections, scan with a kasperky rescue cd.

Fergie76

closed wrote: »

which program is reporting the camera is in use,

I don't know.

closed wrote: »

if it has a light, is it on?

It has light and light is off.

closed wrote: »

Do you have an alternative camera program to test with.

I have tried on Dell Webcam Centre and Skype both say the same.

It was Skype that I first noticed it on.

closed wrote: »

post a hijackthis log

Will do.

closed wrote: »

does the camera device appear to be working in device manager, has the machine had more than one camera device installed?

Device Manager says it's working normally. No other webcam has been installed on machine. I have my DSLR installed, but been working fine with no conflicts, since I got laptop a couple of years ago.

closed wrote: »

if you want a third opinion about infections, scan with a kasperky rescue cd.

I will try this.


Thanks for your help.

closed

you could also try updating the camera driver software by right clicking in device manager, update, or by going to the dell support website, or by using the Dell pc checkup program

also, disable the webcam driver and see if you get the same message

both symptoms, the camera issue and system restore can happen without any infection

Fergie76

I updated camera software tonight. I will try and disable drivers and do the Dell PC Check up.

waddler_8

The mbam detections are all "PUP.Optional" - these are nothing to be unduly concerned about.

Fergie76

It won't let me post the log -

Your request has been blocked.

If you feel you have been blocked in error, please contact Customer Support at [EMAIL="webmaster@moneysavingexpert.com?subject=WAF%20Block%20Page:%205092992694235720903&body=Session%20ID:%20N/A%0D%0DEvent%20ID:%205092992694235720903%0D%0DHost:%20forums.moneysavingexpert.com%0D%0DTime:%20Thu%20Oct%2010%202013%2023:08:04%20GMT+0100%20%28GMT%20Standard%20Time%29%0D%0DReferrer:%20https://forums.moneysavingexpert.com/discussion/comment/63412431#Comment_63412431"]webmaster@moneysavingexpert.com[/EMAIL] for assistance.

*clicking the above email link will automatically add some important details to the email for us to investigate the problem. If the link does not work, please copy and paste all of the information below into an email webmaster@moneysavingexpert.com

Thank you.
Event ID: 5092992694xxxxxxxxxxx Host: forums.moneysavingexpert.com Timestamp: Thu Oct 10 2013 23:08:04 GMT+0100 (GMT Standard Time)

closed

search for system32 and replace with system42 in notepad/wordpad, then post

Fergie76

Tried that, still getting same error message.