Something is wrong with my computer

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > Am I infected? What do I do?

When posting your problem, do not run and post a ComboFix logs. ComboFix is a tool that should only be run under the supervision of someone who has been trained in its use. Using it on your own can cause problems with your computer. Any posts containing CF Logs will be ignored.

To receive help, you should instead provide a detailed description of your problem, detailed word-for-word error messages that you are receiving, screenshots of strange behaviour, and your operating system. This information is much more useful to our helpers than a ComboFix log.

Something is wrong with my computer, system32/services.exe

Options

Jewelleria View Member Profile	Jun 28 2009, 07:16 PM Post #1
Member Group: Members Posts: 64 Joined: 28-June 09 Member No.: 346,354	I am having trouble with my computer. It works part of the time and the other part of the time it shuts itself off. I was infected with some viruses including personal antivirus, but I used this site and malwarebytes and the scan now says I have no problems. My Norton security keeps saying system32 files are trying to access the internet. Norton also says PID 656 is being blocked for a long time now. I am now that good with computers, but this is driving me crazy. Is there any help out there? Thanks, Jewelleria This post has been edited by The weatherman: Jun 28 2009, 07:21 PM Reason for edit: Moved from Vista to a more appropriate forum. Tw

boopme View Member Profile	Jun 28 2009, 07:33 PM Post #2
To INSANITY and BEYOND !! Group: Moderator Posts: 25,454 Joined: 10-September 04 From: NJ USA Member No.: 2,608	Hi and welcome this looks like a worm... i want to run MBAM again. Next run MBAM (MalwareBytes): NOTE: Before saving MBAM please rename it to zztoy.exe....now save it to your desktop. Please download Malwarebytes Anti-Malware and save it to your desktop. alternate download link 1 alternate download link 2 MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes. Make sure you are connected to the Internet. Double-click on mbam-setup.exe to install the application. When the installation begins, follow the prompts and do not make any changes to default settings. When installation has finished, make sure you leave both of these checked: Update Malwarebytes' Anti-Malware Launch Malwarebytes' Anti-Malware Then click Finish. MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install. On the Scanner tab: Make sure the "Perform Quick Scan" option is selected. Then click on the Scan button. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient. When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found". Click OK to close the message box and continue with the removal process. Back at the main Scanner screen: Click on the Show Results button to see a list of any malware that was found. Make sure that *everything is checked, and click Remove Selected. When removal is completed, a log report will open in Notepad. The log is automatically saved and can be viewed by clicking the Logs* tab in MBAM. Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system. Exit MBAM when done. Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. -------------------- How do I get help? Who is helping me? Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook

Jewelleria View Member Profile	Jun 28 2009, 09:34 PM Post #3
Member Group: Members Posts: 64 Joined: 28-June 09 Member No.: 346,354	This is the first time I have ever used any site like this, but it is very helpful. I would like to say thanks. Dell Inspiron 531 Windows Vista Home-service pack 1 32 bit workgroup AMD Athlon 64x2 Dual core Proc 3800+ mem: 2.00GB Malwarebytes' Anti-Malware 1.38 Database version: 2343 Windows 6.0.6001 Service Pack 1 6/28/2009 6:40:53 PM mbam-log-2009-06-28 (18-40-53).txt Scan type: Full Scan (C:\\|D:\\|) Objects scanned: 195737 Time elapsed: 1 hour(s), 2 minute(s), 55 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Malwarebytes' Anti-Malware 1.38 Database version: 2283 Windows 6.0.6001 Service Pack 1 6/28/2009 9:07:42 PM mbam-log-2009-06-28 (21-07-42).txt Scan type: Quick Scan Objects scanned: 75232 Time elapsed: 4 minute(s), 35 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) I did these today. Three days ago I had alot of problems, but it says they are taken care of. I'll show you. Malwarebytes' Anti-Malware 1.38 Database version: 2335 Windows 6.0.6001 Service Pack 1 6/25/2009 9:31:36 PM mbam-log-2009-06-25 (21-31-36).txt Scan type: Full Scan (C:\\|D:\\|) Objects scanned: 193142 Time elapsed: 54 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 1 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 2 Files Infected: 5 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: c:\Users\Mackie19\AppData\Roaming\ErrorSmart (Rogue.ErrorSmart) -> Quarantined and deleted successfully. c:\Users\Mackie19\AppData\Roaming\errorsmart\Log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. Files Infected: c:\programdata\Norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\Norton\BASH\Clone\BHCD518.tmp (Trojan.Dropper) -> Quarantined and deleted successfully. c:\Users\Mackie19\AppData\Roaming\errorsmart\Log\2009 Jun 01 - 04_05_29 PM_931.log (Rogue.ErrorSmart) -> Quarantined and deleted successfully. C:\Program Files\PAV\pav.exe (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\PAV\Personal AntiVirus.lnk (Rogue.PersonalAntiVirus) -> Quarantined and deleted successfully. C:\Windows\Tasks\ErrorSmart Scheduled Scan.job (Rogue.ErrorSmart) -> Quarantined and deleted successfully. I also went to all the files everywhere on my computer and got rid of any PAV files I could find anywhere and deleted them from the recycle bin. My Norton security 2009 still says, everytime my computer goes off and I have to turn it back on, that system 32/services.exe----PID 656 is the problem. Norton, malwarebytes and windows malicious software removal tool all say no virus, or anything wrong. HELP!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

garmanma View Member Profile	Jun 28 2009, 09:58 PM Post #4
Computer Masochist Group: Staff Emeritus Posts: 27,809 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618	No need to post in different forums Boopme should be along with you shortly I see he's still logged in Good luck -------------------- Mark why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter

boopme View Member Profile	Jun 28 2009, 10:17 PM Post #5
To INSANITY and BEYOND !! Group: Moderator Posts: 25,454 Joined: 10-September 04 From: NJ USA Member No.: 2,608	Ok,well you are getting reinfected, So please run these and then we'll check for rootkits. Next run ATF and SAS: This will take at least an hour. Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator". From your regular user account.. Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop .. DO NOT run yet. Open SUPER from icon and install and Update it Under Scanner Options make sure the following are checked (leave all others unchecked): Close browsers before scanning. Scan for tracking cookies. Terminate memory threats before quarantining. Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet. Now reboot into Safe Mode: How to enter safe mode(XP) Using the F8 Method Restart your computer. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu. Select the option for Safe Mode using the arrow keys. Then press enter on your keyboard to boot into Safe Mode. Double-click ATF-Cleaner.exe to run the program. Under Main "Select Files to Delete" choose: Select All. Click the Empty Selected button. If you use Firefox or Opera browser click that browser at the top and choose: Select All Click the Empty Selected button. If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. NOW Scan with SUPER Open from the desktop icon or the program Files list On the left, make sure you check C:\Fixed Drive. Perform a Complete scan. After scan,Verify they are all checked. Click OK on the summary screen to quarantine all found items. If asked if you want to reboot, click "Yes" and reboot normally. To retrieve the removal information after reboot, launch SUPERAntispyware again. Click Preferences, then click the Statistics/Logs tab. Under Scanner Logs, double-click SUPERAntiSpyware Scan Log. If there are several logs, click the current dated log and press View log. A text file will open in your default text editor. Please copy and paste the Scan Log results in your next reply. Click Close to exit the program. Please ask any needed questions,post logs and Let us know how the PC is running now. -------------------- How do I get help? Who is helping me? Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook

Jewelleria View Member Profile	Jun 29 2009, 12:22 AM Post #6
Member Group: Members Posts: 64 Joined: 28-June 09 Member No.: 346,354	SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 06/29/2009 at 00:01 AM Application Version : 4.26.1006 Core Rules Database Version : 3960 Trace Rules Database Version: 1901 Scan type : Quick Scan Total Scan Time : 00:33:01 Memory items scanned : 265 Memory threats detected : 0 Registry items scanned : 478 Registry threats detected : 0 File items scanned : 87520 File threats detected : 0 To do a complete scan you have to get the full version of this software. I can't put my credit card out there right now. I just can't, with the problems I have been having. If I see this version at the store tomorrow I'll pick it up. Here are the results from the scan. There is nothing to report. I'll watch the computer function for a day or two and let you know if it is still acting up. I'll probably post on a different page though, I am getting lost on this one. Thanks alot for your help, Jewelleria This post has been edited by boopme: Jun 29 2009, 09:48 AM

Jewelleria View Member Profile	Jun 29 2009, 01:01 AM Post #7
Member Group: Members Posts: 64 Joined: 28-June 09 Member No.: 346,354	I decided to go to C:\windows\system32\services.exe, and I opened it. It is a blank page. It has also disappeared from the task manager. Norton security keeps saying this thing is a problem. Do I need this file for my computer, and do other people have it. I didn't tell you this before because I didn't think of it. When I was going through all of the files on my computer, someone called trusted installer put theirself as administrator of my computer. I fixed it after fighting with it for awhile, because I didn't know where to go after I found out about it. I got directions and went back in for the fix. It really freaked me out. SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 06/29/2009 at 00:01 AM Application Version : 4.26.1006 Core Rules Database Version : 3960 Trace Rules Database Version: 1901 Scan type : Quick Scan Total Scan Time : 00:33:01 Memory items scanned : 265 Memory threats detected : 0 Registry items scanned : 478 Registry threats detected : 0 File items scanned : 87520 File threats detected : 0 To do a complete scan you have to get the full version of this software. I can't put my credit card out there right now. I just can't, with the problems I have been having. If I see this version at the store tomorrow I'll pick it up. Here are the results from the scan. There is nothing to report. I'll watch the computer function for a day or two and let you know if it is still acting up. Thanks alot for your help, Jewelleria This post has been edited by boopme: Jun 29 2009, 09:49 AM

boopme View Member Profile	Jun 29 2009, 09:53 AM Post #8
To INSANITY and BEYOND !! Group: Moderator Posts: 25,454 Joined: 10-September 04 From: NJ USA Member No.: 2,608	Hello every tool I give you you can use Free.. i use these everyday here and on my PC's.. After c licking download are you scrolling down to Free Home Users Version? Also you need only use the Add reply not the quote... we don't need it. thanks ..it's easier for both of us. In Windows Vista you may be seeing a process running called TrustedInstaller.EXE. The name TrustedInstaller looks so friendly that many would think this could be a virus or malware. Relax, TrustedInstaller.EXE is a process that is built into Windows Vista. Some may find the TrustedInstaller process because their PC is running slow and they use Task Manager to determine which processing hogging the CPU. Many have reported seeing TrustedInstaller.Exe using 100% of the CPU. Were you experiencing this? This post has been edited by boopme: Jun 29 2009, 10:18 AM -------------------- How do I get help? Who is helping me? Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook

Jewelleria View Member Profile	Jun 29 2009, 10:27 AM Post #9
Member Group: Members Posts: 64 Joined: 28-June 09 Member No.: 346,354	Yes I found the free version of the superspyware and ran it. I was just saying to run a complete scan it said to buy the other version. No big deal. I ran the free version and it said no problems. Thank you so much. My computer hasn't shut off so far this morning. I was wondering about the C:\windows\system32\services.exe, do other people have this on there computer. It has disappeared from task manager. It must still be on my computer somewhere because last night sometime my Norton security blocked it. Also when I opened the file for services.exe it was empty. Thanks so much for your help. I am learning how to fix alot of problems otherwise wouldn't be able to get fixed.

Jewelleria View Member Profile	Jun 29 2009, 02:23 PM Post #10
Member Group: Members Posts: 64 Joined: 28-June 09 Member No.: 346,354	You know where you go to see who the administator to the computer is? I went there because I couldn't get a program to run that I wanted to use. Anyway it looks like this Blah, Blah (Administrator) Blah, Blah (User) Blah (User) I have looked in this before and no one called trusted installer was there. When I looked while I was having the virus trouble it was there Trusted installer (Administrater) ME (User) Blah, Blah (User) The trusted installer was the Administrator and me and anyone else that uses the computer was restricted access. I deleted it after taking control back of my computer. It wouldn't go at first, I took ownership of it. I can't remember eveything I had to do, but it took a little while to get it off and get control back. Like I said it wasn't on there before.

boopme View Member Profile	Jun 29 2009, 02:33 PM Post #11
To INSANITY and BEYOND !! Group: Moderator Posts: 25,454 Joined: 10-September 04 From: NJ USA Member No.: 2,608	Hi, Yes the services can be both legit or malware determined by the location and size ... But you appear to have some other embedded issues that will not show here. So you will need to run HJT/DDS. Please follow this guide. go and do steps 6 and 7 ,, Preparation Guide For Use Before Using Hijackthis. Then go here HijackThis Logs and Virus/Trojan/Spyware/Malware Removal ,click New Topic,give it a relevant Title and post that complete log. Let me know if it went OK. -------------------- How do I get help? Who is helping me? Staying Updated Calendar of Updates. For the time will come when men will not put up with sound doctrine. Instead, to suit their own desires, they will gather around them a great number of teachers to say what their itching ears want to hear.... Become a BleepingComputer fan: Facebook

Orange Blossom View Member Profile	Jun 29 2009, 11:08 PM Post #12
OBleepin Investigator Group: Moderator Posts: 20,273 Joined: 14-July 06 From: Bloomington, IN Member No.: 76,150	Hello, Now that you have posted a log here: http://www.bleepingcomputer.com/forums/topic237629.html you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer. From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean. Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible To avoid confusion, I am closing this topic. Good luck with your log. Orange Blossom -------------------- Orange Blossom An ounce of prevention is worth a pound of cure ESET NOD32, SuperAntiSpyware Pro, SpywareBlaster, Spybot 1.6.2.46, WinPatrol Plus, Sunbelt Personal Firewall - Full, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

« Next Oldest · Am I infected? What do I do? · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 19th March 2010 - 11:08 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides