BleepingComputer.com: Something is wrong with my computer

I am having trouble with my computer. It works part of the time and the other part of the time it shuts itself off. I was infected with some viruses including personal antivirus, but I used this site and malwarebytes and the scan now says I have no problems. My Norton security keeps saying system32 files are trying to access the internet. Norton also says PID 656 is being blocked for a long time now. I am now that good with computers, but this is driving me crazy. Is there any help out there?
Thanks, Jewelleria

Hi and welcome this looks like a worm... i want to run MBAM again.

Next run MBAM (MalwareBytes):

NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

• Make sure you are connected to the Internet.
  
• Double-click on mbam-setup.exe to install the application.
  
• When the installation begins, follow the prompts and do not make any changes to default settings.
  
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
    
  • Launch Malwarebytes' Anti-Malware
  
  
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  
• If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
  
• Then click on the Scan button.
  
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When removal is completed, a log report will open in Notepad.
  
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  
• Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  
• Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

This is the first time I have ever used any site like this, but it is very helpful. I would like to say thanks.
Dell Inspiron 531 Windows Vista Home-service pack 1 32 bit workgroup
AMD Athlon 64x2 Dual core Proc 3800+ mem: 2.00GB

Malwarebytes' Anti-Malware 1.38
Database version: 2343
Windows 6.0.6001 Service Pack 1

6/28/2009 6:40:53 PM
mbam-log-2009-06-28 (18-40-53).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 195737
Time elapsed: 1 hour(s), 2 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





Malwarebytes' Anti-Malware 1.38
Database version: 2283
Windows 6.0.6001 Service Pack 1

6/28/2009 9:07:42 PM
mbam-log-2009-06-28 (21-07-42).txt

Scan type: Quick Scan
Objects scanned: 75232
Time elapsed: 4 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I did these today. Three days ago I had alot of problems, but it says they are taken care of.
I'll show you.
Malwarebytes' Anti-Malware 1.38
Database version: 2335
Windows 6.0.6001 Service Pack 1

6/25/2009 9:31:36 PM
mbam-log-2009-06-25 (21-31-36).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 193142
Time elapsed: 54 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\Users\Mackie19\AppData\Roaming\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
c:\Users\Mackie19\AppData\Roaming\errorsmart\Log (Rogue.ErrorSmart) -> Quarantined and deleted successfully.

Files Infected:
c:\programdata\Norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\Norton\BASH\Clone\BHCD518.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\Users\Mackie19\AppData\Roaming\errorsmart\Log\2009 Jun 01 - 04_05_29 PM_931.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully.
C:\Program Files\PAV\pav.exe (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\PAV\Personal AntiVirus.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully.
C:\Windows\Tasks\ErrorSmart Scheduled Scan.job (Rogue.ErrorSmart) -> Quarantined and deleted successfully.


I also went to all the files everywhere on my computer and got rid of any PAV files I could find anywhere and deleted them from the recycle bin.

My Norton security 2009 still says, everytime my computer goes off and I have to turn it back on, that system 32/services.exe----PID 656 is the problem.
Norton, malwarebytes and windows malicious software removal tool all say no virus, or anything wrong.
HELP!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

No need to post in different forums
Boopme should be along with you shortly
I see he's still logged in
Good luck

Ok,well you are getting reinfected, So please run these and then we'll check for rootkits.

Next run ATF and SAS: This will take at least an hour.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post logs and Let us know how the PC is running now.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/29/2009 at 00:01 AM

Application Version : 4.26.1006

Core Rules Database Version : 3960
Trace Rules Database Version: 1901

Scan type : Quick Scan
Total Scan Time : 00:33:01

Memory items scanned : 265
Memory threats detected : 0
Registry items scanned : 478
Registry threats detected : 0
File items scanned : 87520
File threats detected : 0

To do a complete scan you have to get the full version of this software. I can't put my credit card out there right now. I just can't, with the problems I have been having. If I see this version at the store tomorrow I'll pick it up.
Here are the results from the scan. There is nothing to report. I'll watch the computer function for a day or two and let you know if it is still acting up. I'll probably post on a different page though, I am getting lost on this one. Thanks alot for your help, Jewelleria

I decided to go to C:\windows\system32\services.exe, and I opened it. It is a blank page. It has also disappeared from the task manager. Norton security keeps saying this thing is a problem. Do I need this file for my computer, and do other people have it. I didn't tell you this before because I didn't think of it. When I was going through all of the files on my computer, someone called trusted installer put theirself as administrator of my computer. I fixed it after fighting with it for awhile, because I didn't know where to go after I found out about it. I got directions and went back in for the fix. It really freaked me out.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 06/29/2009 at 00:01 AM

Application Version : 4.26.1006

Core Rules Database Version : 3960
Trace Rules Database Version: 1901

Scan type : Quick Scan
Total Scan Time : 00:33:01

Memory items scanned : 265
Memory threats detected : 0
Registry items scanned : 478
Registry threats detected : 0
File items scanned : 87520
File threats detected : 0

To do a complete scan you have to get the full version of this software. I can't put my credit card out there right now. I just can't, with the problems I have been having. If I see this version at the store tomorrow I'll pick it up.
Here are the results from the scan. There is nothing to report. I'll watch the computer function for a day or two and let you know if it is still acting up.

Thanks alot for your help, Jewelleria

Hello every tool I give you you can use Free.. i use these everyday here and on my PC's..
After c licking download are you scrolling down to Free Home Users Version?

Also you need only use the Add reply not the quote... we don't need it. thanks ..it's easier for both of us.


In Windows Vista you may be seeing a process running called TrustedInstaller.EXE. The name TrustedInstaller looks so friendly that many would think this could be a virus or malware. Relax, TrustedInstaller.EXE is a process that is built into Windows Vista. Some may find the TrustedInstaller process because their PC is running slow and they use Task Manager to determine which processing hogging the CPU. Many have reported seeing TrustedInstaller.Exe using 100% of the CPU. Were you experiencing this?

Yes I found the free version of the superspyware and ran it. I was just saying to run a complete scan it said to buy the other version. No big deal. I ran the free version and it said no problems. Thank you so much. My computer hasn't shut off so far this morning.

I was wondering about the C:\windows\system32\services.exe, do other people have this on there computer. It has disappeared from task manager. It must still be on my computer somewhere because last night sometime my Norton security blocked it. Also when I opened the file for services.exe it was empty.

Thanks so much for your help. I am learning how to fix alot of problems otherwise wouldn't be able to get fixed.

You know where you go to see who the administator to the computer is? I went there because I couldn't get a program to run that I wanted to use. Anyway it looks like this

Blah, Blah (Administrator)
Blah, Blah (User)
Blah (User)

I have looked in this before and no one called trusted installer was there.
When I looked while I was having the virus trouble it was there
Trusted installer (Administrater)
ME (User)
Blah, Blah (User)

The trusted installer was the Administrator and me and anyone else that uses the computer was restricted access. I deleted it after taking control back of my computer. It wouldn't go at first, I took ownership of it.
I can't remember eveything I had to do, but it took a little while to get it off and get control back.
Like I said it wasn't on there before.

Hi, Yes the services can be both legit or malware determined by the location and size ... But you appear to have some other embedded issues that will not show here.
So you will need to run HJT/DDS.
Please follow this guide. go and do steps 6 and 7 ,, Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log.

Let me know if it went OK.

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic237629.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom