Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Virus Causing Internet Problem


  • Please log in to reply
4 replies to this topic

#1 jkittle

jkittle

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 20 May 2008 - 07:10 AM

I have contracted some sort of virus that has changed the color of my desk top, causing an error message to pop up when the computer starts and when I log onto the internet I get redirected and a message "Insecure internet activity. Threat of Virus attack" .

I have run Spybot, Ad-Aware and Malwarebytes' Anti-Malware and noting helps.

Anyone have any suggestions?

Jerry

Edit: Moved topic from Web Browsing/Email and Other Internet Applications to the more appropriate forum. ~ Animal

BC AdBot (Login to Remove)

 


#2 jkittle

jkittle
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 20 May 2008 - 08:05 AM

Here is my system scan.

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Pentium® 4 CPU 2.80GHz
Percentage of Memory in Use: 41%
Physical Memory (total/avail): 765.98 MiB / 445.36 MiB
Pagefile Memory (total/avail): 1873.61 MiB / 1606.25 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1921 MiB

C: is Fixed (NTFS) - 37.21 GiB total, 30.56 GiB free.
D: is CDROM (No Media)
F: is Network (NTFS)
I: is Network (NTFS)
M: is Network (NTFS)
P: is Network (NTFS)
Q: is Network (NTFS)
R: is Network (NTFS)

\\.\PHYSICALDRIVE0 - WDC WD400BB-75JHC0 - 37.25 GiB - 2 partitions
\PARTITION0 - Unknown - 39.19 MiB
\PARTITION1 (bootable) - Installable File System - 37.21 GiB - C:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

FirstRunDisabled is set.
AntiVirusDisableNotify is set.

AV: Symantec AntiVirus Corporate Edition v9.0.2.1000 (Symantec Corporation) Outdated

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\jerry\Application Data
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=OFFICE15
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\jerry
LOGONSERVER=\\SV2
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\Program Files\Internet Explorer;;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 15 Model 4 Stepping 1, GenuineIntel
PROCESSOR_LEVEL=15
PROCESSOR_REVISION=0401
ProgramFiles=C:\Program Files
PROMPT=$P$G
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\jerry\LOCALS~1\Temp
TMP=C:\DOCUME~1\jerry\LOCALS~1\Temp
USERDNSDOMAIN=NC.TEAMEMERGENT.COM
USERDOMAIN=TEAMEMERGENT
USERNAME=jerry
USERPROFILE=C:\Documents and Settings\jerry
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

jerry (admin)
Administrator (admin)


-- Add/Remove Programs ---------------------------------------------------------

--> MsiExec.exe /I{901C0409-6000-11D3-8CFE-0150048383C9}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
4TOPS Excel Import Assistant in MS Access 2K 6.0 --> "C:\AddIns\uninst\unins000.exe"
Ad-Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD-AWA~1\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD-AWA~1\INSTALL.LOG
Adobe Flash Player ActiveX --> C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 8.1.2 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
Canon Camera Access Library --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CAL\Uninst.ini"
Canon Camera Support Core Library --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CSCLIB\Uninst.ini"
Canon Camera Window DC_DV 5 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini"
Canon Camera Window DC_DV 6 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"
Canon Camera Window MC 6 for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowMC\Uninst.ini"
Canon G.726 WMP-Decoder --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\G726Decoder\G726DecUnInstall.ini"
Canon MovieEdit Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini"
Canon RAW Image Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini"
Canon RemoteCapture Task for ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"
Canon Utilities EOS Utility --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini"
Canon Utilities PhotoStitch --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"
Canon Utilities ZoomBrowser EX --> "C:\Program Files\Common Files\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini"
Cost Estimate 2.46 --> "C:\Program Files\Cost Estimate\unins000.exe"
Dell Resource CD --> MsiExec.exe /X{FCD9CD52-7222-4672-94A0-A722BA702FD0}
DeskTopBinder V2 Lite --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DD30D7C5-DD1A-46E7-9CA6-03CF6A398990}\Setup.exe" -l0x9 UNINSTALL
GeneralCOST Estimator Trial --> MsiExec.exe /X{5A8769BC-756A-4251-A9A5-14D238FDC63E}
Hotfix for Windows Media Format 11 SDK (KB929399) --> "C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Inactive Shut Down Control v2.1 for MS Access --> "C:\Program Files\Peters Software\Inactive Shut Down Control for MS Access\unins000.exe"
Intel® Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
Intel® PRO Network Adapters and Drivers --> Prounstl.exe
LiveUpdate 2.0 (Symantec Corporation) --> C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Compression Client Pack 1.0 for Windows XP --> "C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Office Access 2003 --> MsiExec.exe /I{90150409-6000-11D3-8CFE-0150048383C9}
Microsoft Office Small Business Edition 2003 --> MsiExec.exe /I{91CA0409-6000-11D3-8CFE-0150048383C9}
Microsoft User-Mode Driver Framework Feature Pack 1.0 --> "C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
MSMail2003 --> MsiExec.exe /I{5CF5C6EF-09AB-4B4C-9816-44F4EDCC406B}
Production Monitor --> MsiExec.exe /I{350C12F7-862B-4ABB-9069-2789A6E8CC49}
RoofCOST Estimator Trial --> MsiExec.exe /X{9760C863-9239-4C78-A648-5413D1FB4BFC}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
SoundMAX --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\SETUP.exe" -l0x9 -removeonly
Spybot - Search & Destroy 1.3 --> "C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Symantec AntiVirus --> MsiExec.exe /I{848AC794-8B81-440A-81AE-6474337DB527}
Topics --> MsiExec.exe /I{880A7658-921B-4260-B164-40DEA5B9614A}
TrackPro Version 3.0.0.0206 --> C:\Program Files\TrackPro\uninst.exe
Visual SQL-Designer --> C:\PROGRA~1\VISUAL~1\VISUAL~1\UNWISE.EXE C:\PROGRA~1\VISUAL~1\VISUAL~1\INSTALL.LOG
VNC Free Edition 4.1.1 --> "C:\Program Files\RealVNC\VNC4\unins000.exe"
Windows Media Format 11 runtime --> "C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"


-- Application Event Log -------------------------------------------------------

Event Record #/Type5171 / Warning
Event Submitted/Written: 05/20/2008 01:58:56 AM
Event ID/Source: 6 / Symantec AntiVirus
Event Description:
Scan could not open file C:\WINDOWS\system32\config\system.LOG [00000003]

Event Record #/Type5170 / Warning
Event Submitted/Written: 05/20/2008 01:58:56 AM
Event ID/Source: 6 / Symantec AntiVirus
Event Description:
Scan could not open file C:\WINDOWS\system32\config\system [00000003]

Event Record #/Type5169 / Warning
Event Submitted/Written: 05/20/2008 01:58:56 AM
Event ID/Source: 6 / Symantec AntiVirus
Event Description:
Scan could not open file C:\WINDOWS\system32\config\software.LOG [00000003]

Event Record #/Type5168 / Warning
Event Submitted/Written: 05/20/2008 01:58:56 AM
Event ID/Source: 6 / Symantec AntiVirus
Event Description:
Scan could not open file C:\WINDOWS\system32\config\software [00000003]

Event Record #/Type5167 / Warning
Event Submitted/Written: 05/20/2008 01:58:56 AM
Event ID/Source: 6 / Symantec AntiVirus
Event Description:
Scan could not open file C:\WINDOWS\system32\config\SECURITY.LOG [00000003]



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type1371 / Error
Event Submitted/Written: 05/19/2008 03:13:59 PM
Event ID/Source: 10005 / DCOM
Event Description:
DCOM got error "%%1058" attempting to start the service wuauserv with arguments ""
in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

Event Record #/Type1363 / Warning
Event Submitted/Written: 05/19/2008 06:13:17 AM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server ldap/sv1.nc.teamemergent.com/nc.teamemergent.com@nc.teamemergent.com. No authentication protocol was available.

Event Record #/Type1362 / Warning
Event Submitted/Written: 05/19/2008 04:37:17 AM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server ldap/sv1.nc.teamemergent.com/nc.teamemergent.com@nc.teamemergent.com. No authentication protocol was available.

Event Record #/Type1361 / Warning
Event Submitted/Written: 05/19/2008 03:06:17 AM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server ldap/sv1.nc.teamemergent.com/nc.teamemergent.com@nc.teamemergent.com. No authentication protocol was available.

Event Record #/Type1360 / Warning
Event Submitted/Written: 05/19/2008 01:16:17 AM
Event ID/Source: 8193 / LSASRV
Event Description:
The Security System could not establish a secured connection with the server ldap/sv1.nc.teamemergent.com/nc.teamemergent.com@nc.teamemergent.com. No authentication protocol was available.



-- End of Deckard's System Scanner: finished at 2008-05-20 09:02:30 ------------

#3 jgweed

jgweed

  • Members
  • 28,473 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Chicago, Il.
  • Local time:08:59 AM

Posted 20 May 2008 - 08:24 AM

It is not clear that your problem is caused by a virus. What is the exact error message that pops up when you boot your computer?
Is your Anti-virus current in its definitions, have you thoroughly scanned your hard drive, and what did it find?
Are you able to determine, secondly, what application is giving the second message when you connect to the internet?
Regards,
John
Whereof one cannot speak, thereof one should be silent.

#4 jkittle

jkittle
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 20 May 2008 - 09:04 AM

How do you post attachments? I can post the screen shot of what comes up

#5 jkittle

jkittle
  • Topic Starter

  • Members
  • 17 posts
  • OFFLINE
  •  
  • Local time:09:59 AM

Posted 20 May 2008 - 09:42 AM

I have found this. It takes over my whole desk top and re-directs my web browsers. I have tried to delete it but it comes back when the computer starts up.

O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users