Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Need Help. My computer must be infected.


  • This topic is locked This topic is locked
3 replies to this topic

#1 Rkinsey1313

Rkinsey1313

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 09 April 2010 - 11:51 PM

I believe I have something on my computer. I have to restore it daily in order to do anything. It starts out fast as hell and just get slower and slower. In 3-4 hours it take like 30 seconds to open a web page. I play a game online and it becomes full of latency and unable to play. I have mbam and run it nightly. It seems to find something on a daily basis. The last 2 nights Ive deleted 7 infections but it still is having issues. Whatever it is, I dont think mbam is finding it. Someone help plz.

EDIT: Split from http://www.bleepingcomputer.com/forums/ind...p;#entry1708206 ~ Hamluis.

Edited by hamluis, 10 April 2010 - 07:28 AM.


BC AdBot (Login to Remove)

 


#2 Rkinsey1313

Rkinsey1313
  • Topic Starter

  • Members
  • 11 posts
  • OFFLINE
  •  
  • Local time:01:47 AM

Posted 17 April 2010 - 08:04 AM

Im having issues with my computer. I have malwarebytes and combofix downloaded to my computer. I have ran Malwarebytes a few times overnight and it seems to find at least 1 or 2 viruses everytime. My computer is noticably slower. I use this computer solely for playing a mmorpg and the latency on it gets bad. Sometimes when I delete the viruses with malwarebytes or Combofix, the computer will run faster. But thats only sometimes. I need to restore my computer so I can get a good days worth of the game I play without horrible latency. I dont have any other type of anti virus on my computer and whatever the virus is that causing my problems must be undetectable with malwarebytes or somethin. So I really could use some pro help with this plz. Thank you. Oh And I just ran combofix so here is a log report if u need it.

ComboFix 10-04-15.05 - HP_Administrator 04/17/2010 5:44.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.554 [GMT -7:00]
Running from: c:\documents and settings\HP_Administrator\Desktop\comfix.exe
.

((((((((((((((((((((((((( Files Created from 2010-03-17 to 2010-04-17 )))))))))))))))))))))))))))))))
.

2010-04-17 02:23 . 2001-08-17 20:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2010-04-17 02:23 . 2004-08-04 05:58 14848 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2010-04-17 02:23 . 2001-08-17 21:02 9600 ----a-w- c:\windows\system32\drivers\hidusb.sys
2010-04-17 02:23 . 2010-04-17 02:23 -------- d-----w- c:\windows\LastGood
2010-04-17 01:27 . 2005-11-11 01:03 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Symantec
2010-04-17 01:27 . 2005-11-11 00:44 -------- d-----w- c:\documents and settings\HP_Administrator\WINDOWS
2010-04-17 01:27 . 2010-04-17 01:32 -------- d-----w- c:\documents and settings\HP_Administrator
2010-04-17 01:26 . 2005-11-11 00:44 -------- d-----w- c:\windows\system32\config\systemprofile\WINDOWS
2010-04-17 00:54 . 2010-04-17 01:29 -------- d-sh--r- c:\windows\system32\dllcache
2010-04-12 16:59 . 2010-04-17 01:32 -------- d-----w- C:\USERDATA
2010-04-09 00:19 . 2010-04-09 00:19 57344 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-04-09 00:19 . 2010-04-09 00:19 56766 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-04-09 00:19 . 2010-04-09 00:19 56978 ----a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe
2010-04-09 00:15 . 2010-04-09 00:15 144696 ----a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-04-05 20:54 . 2010-04-05 20:54 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\acccore
2010-04-05 20:54 . 2010-04-05 23:00 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\AIM
2010-04-05 20:54 . 2010-04-05 20:54 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\AOL
2010-04-05 20:52 . 2010-04-05 20:52 -------- d-----w- c:\program files\Common Files\Software Update Utility
2010-04-05 20:52 . 2010-04-05 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\AIM
2010-04-05 20:52 . 2010-04-05 20:52 -------- d-----w- c:\program files\AIM Search
2010-04-05 20:52 . 2010-04-05 20:52 -------- d-----w- c:\program files\AIM
2010-04-05 20:47 . 2010-04-15 21:26 -------- d-----w- c:\program files\PokerStars.NET
2010-04-01 05:40 . 2010-04-01 05:40 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Helper
2010-03-30 02:03 . 2010-03-30 02:17 -------- d-----w- C:\comfix
2010-03-29 15:53 . 2010-03-29 15:53 1956808 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-03-20 04:36 . 2010-03-20 04:36 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-17 12:36 . 2009-10-09 22:49 -------- d-----w- c:\program files\Diablo II
2010-04-17 03:21 . 2005-11-11 01:02 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-04-17 01:38 . 2005-11-11 01:02 -------- d-----w- c:\program files\Symantec
2010-04-17 01:36 . 2005-11-11 01:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2010-04-17 01:34 . 2005-11-11 00:30 -------- d-----w- c:\program files\DISC
2010-04-17 01:30 . 2010-04-17 01:27 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Digital Interactive Systems Corporation
2010-04-17 01:28 . 2010-04-17 01:28 1854 --sha-r- c:\windows\system32\drivers\103C_HP_CPC_EL448AA-ABA a1310n_YC_0Pavi_QCNH550_E61NAemMPC1_48_IAmberine M_SASUSTek Computer INC._V1.03_B3.13_T051115_WXP2_L409_M959_J200_7AMD_8Athlon 64_92.19_#060122_N10EC8139_Z14F12F20_G10025954.MRK
2010-04-10 05:16 . 2009-12-24 21:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-04-09 00:19 . 2010-03-17 04:07 -------- d-----w- c:\documents and settings\All Users\Application Data\DivX
2010-04-09 00:19 . 2009-03-19 20:16 -------- d-----w- c:\program files\DivX
2010-04-09 00:15 . 2010-03-17 04:10 754984 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll
2010-04-09 00:15 . 2010-03-17 04:10 1180952 ----a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe
2010-04-05 20:52 . 2009-09-26 19:08 -------- d-----w- c:\program files\Common Files\AOL
2010-03-17 04:10 . 2010-03-17 04:10 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\DivX
2010-03-12 06:49 . 2010-03-17 04:10 530625 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Plus DirectShow Filters\DivXDSFiltersUninstall.exe
2010-03-12 06:48 . 2010-03-17 04:10 530625 ----a-w- c:\documents and settings\All Users\Application Data\DivX\DivX7\DivX Converter\DivXConverterUninstall.exe
2010-02-27 06:55 . 2010-02-27 06:55 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Netscape
2010-02-26 18:05 . 2010-02-26 18:05 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Yahoo!
2010-02-26 18:05 . 2009-12-18 22:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-02-25 04:18 . 2010-02-25 04:18 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Malwarebytes
2010-02-25 00:31 . 2010-04-17 01:27 139 ----a-w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\fusioncache.dat
2010-01-22 12:23 . 2010-01-22 12:23 249856 ------w- c:\windows\Setup1.exe
2010-01-22 12:23 . 2009-11-26 03:28 73216 ----a-w- c:\windows\ST6UNST.EXE
2007-02-03 04:42 . 2008-12-05 00:49 22 --sha-w- c:\windows\SMINST\HPCD.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

Edited by Orange Blossom, 17 April 2010 - 09:51 PM.
Merged topics and move to log forum. ~ OB


#3 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:08:47 AM

Posted 18 April 2010 - 05:03 AM

Hello ,
And welcome.gif to the Bleeping Computer Malware Removal Forum
. My name is Elise and I'll be glad to help you with your computer problems.


I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
  • The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
  • Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
  • The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
  • Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.
You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications. The topics you are tracking are shown here.
-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:
  • Please download OTL from one of the following mirrors:
  • Save it to your desktop.
  • Double click on the icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the button.
  • Two reports will open, copy and paste them in a reply here:
    • OTListIt.txt <-- Will be opened
    • Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:
  • Main Mirror
    This version will download a randomly named file (Recommended)
  • Zipped Mirror
    This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.
  • Disconnect from the Internet and close all running programs.
  • Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
  • Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
  • Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.


  • GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
  • If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
  • Now click the Scan button. If you see a rootkit warning window, click OK.
  • When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
  • Click the Copy button and paste the results into your next reply.
  • Exit GMER and re-enable all active protection when done.
-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------
In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply
  • A detailed description of your problems
  • A new OTL log (don't forget extra.txt)
  • GMER log

Thanks and again sorry for the delay.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft


#4 Elise

Elise

    Bleepin' Blonde


  • Malware Study Hall Admin
  • 61,205 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Romania
  • Local time:08:47 AM

Posted 26 April 2010 - 02:09 PM

Due to lack of feedback, this topic will now be closed.

If you are the original topic starter and you need it reopened, please send me a PM.

Everyone else, please start a new topic.

regards, Elise


"Now faith is the substance of things hoped for, the evidence of things not seen."

 

Follow BleepingComputer on: Facebook | Twitter | Google+ | lockerdome

 

Malware analyst @ Emsisoft





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users