Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Not sure of virus/trojan name but uses 100% CPU


  • This topic is locked This topic is locked
5 replies to this topic

#1 dilemmaemma

dilemmaemma

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:55 AM

Posted 08 June 2010 - 04:26 PM

Months ago, my prior anti-virus, Avast, showed I had been infected by a virus. I followed the instructions of the program but continued to have problems that convinced me my system was not clean. I did a complete system restore using disks I made when the computer was new. After my computer was restored, I had trouble accessing the internet. I am on a wireless network and the computer showed the radio was working, I had an excellent signal, the computer was connected to the network but no pages would load in Internet Explorer, FireFox or Chrome.

I left the computer sitting for a few week so I would not pitch it out the window and when I hooked it up again and did a few minor tweaks like entering my IP address manually it worked. For about a week. Then my firewall would disable as I was sitting there (I would immediately turn it on again) and sometimes it seemed like my mouse cursor was moving without my help. Convinced my computer was being accessed from the outside, I turned off my wireless radio. I scanned my system with Malwarebytes and it found nothing but when I scanned it with AVG, Malwarebytes opened on its own and showed various viruses & trojans. I moved these into a virus vault and eventually deleted them through the program. The computer still was not acting properly and then I noticed AVG was not scanning hidden or locked files. I used Unlocker to unlock some files that appeared infected and deleted these but when I tried to empty my recycle bin, rather than deleting the files, the files seemed to replicate. Once this happened I stopped everything, joined your forum and followed the instructions to create this post. I am posting this on my laptop. All programs used to diagnose the problem were transferred by thumb drive (which I have checked for viruses, repeatedly) and the logs were transferred back to the laptop via thumb drive. My desktop computer is the one infected. Also of interest, every time I shut down my desktop it tells me updates are available. It has been doing this for two weeks. Several days ago I stopped installing these updates because it seems unusual there would be updates every single time I shut down my computer.

DDS (Ver_10-03-17.01) - NTFSx86
Run by HP_Administrator at 14:11:12.01 on Tue 06/08/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_20
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.958.477 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\arservice.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
svchost.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wltrysvc.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\DISC\DISCover.exe
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Sonic\DigitalMedia Plus\DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\DISC\DiscGui.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Documents and Settings\HP_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: hpWebHelper Class: {aaae832a-5fff-4661-9c8f-369692d1dcb9} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\plugin\WebHelper.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\hp_administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [AlwaysReady Power Message APP] ARPWRMSG.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [DISCover] c:\program files\disc\DISCover.exe
mRun: [DiscUpdateManager] c:\program files\disc\DiscUpdateMgr.exe
mRun: [DMAScheduler] c:\program files\sonic\digitalmedia plus\digitalmedia archive\DMAScheduler.exe
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [PCDrProfiler]
mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run
mRun: [IcoSet] c:\hp\bin\cloaker.exe c:\hp\bin\icoset\adjust.bat seticon
mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: trymedia.com
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1275399576890
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
TCP: {C856B2D3-2E82-4D70-BF62-F32B39FEF282} = 192.168.1.1,71.243.0.12
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-5-26 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-5-26 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-5-26 242896]
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\avg\avg9\avgemc.exe [2010-5-26 916760]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-5-26 308064]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-6 99328]
S3 PCD5SRVC{085326CB-51A3560A-05010003};PCD5SRVC{085326CB-51A3560A-05010003} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\PCD5SRVC.pkms [2005-11-21 21120]

=============== Created Last 30 ================

2010-06-08 18:01:14 0 ----a-w- c:\documents and settings\hp_administrator\defogger_reenable
2010-06-08 14:09:09 0 d-----w- c:\docume~1\hp_adm~1\applic~1\EMCO
2010-06-07 13:47:01 0 d-----w- c:\program files\Unlocker
2010-06-03 15:46:22 0 d-----w- c:\program files\common files\HP
2010-06-03 15:38:45 0 d-----w- c:\program files\HP
2010-06-03 15:37:53 69372 ----a-w- c:\windows\hpoins05.dat
2010-06-03 15:37:52 19696 ------w- c:\windows\hpomdl05.dat
2010-06-03 14:47:20 46 ----a-w- c:\windows\hpqscr01.dat
2010-06-03 14:45:49 46 ----a-w- c:\windows\hposcr05.dat
2010-06-03 01:16:54 274288 ----a-w- c:\windows\system32\mucltui.dll
2010-06-02 19:58:26 0 d-----w- c:\windows\system32\wbem\Repository
2010-06-02 19:26:52 0 d-----w- c:\program files\Trend Micro
2010-06-02 15:59:12 16736 ----a-w- c:\windows\system32\mucltui.dll.mui
2010-06-01 18:07:09 0 d-----w- c:\docume~1\hp_adm~1\applic~1\HpUpdate
2010-05-31 18:09:13 73728 ----a-w- c:\windows\system32\javacpl.cpl
2010-05-31 18:09:13 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-05-30 17:03:06 0 d-----w- c:\windows\system32\CatRoot_bak
2010-05-30 03:21:48 272128 ------w- c:\windows\system32\drivers\bthport.sys
2010-05-30 03:21:48 272128 ------w- c:\windows\system32\dllcache\bthport.sys
2010-05-30 03:17:37 2137088 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe
2010-05-30 03:17:36 2181376 ------w- c:\windows\system32\dllcache\ntoskrnl.exe
2010-05-30 03:17:36 2016768 ------w- c:\windows\system32\dllcache\ntkrpamp.exe
2010-05-30 03:17:35 2058368 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe
2010-05-30 00:49:19 0 d-----w- c:\windows\system32\PreInstall
2010-05-29 20:51:53 0 d--h--w- C:\$AVG
2010-05-29 20:45:56 0 d-----w- c:\windows\system32\SoftwareDistribution
2010-05-27 15:58:40 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2010-05-27 15:58:40 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys
2010-05-27 15:58:24 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-05-27 15:58:24 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2010-05-27 15:58:10 31616 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-05-27 15:58:10 31616 ----a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-05-26 22:51:22 0 d-----w- c:\docume~1\hp_adm~1\applic~1\com.marketmetweet.TweetBrand.FA8B43D61D3087B06BE0F9955DC4BD64A4A0ABAD.1
2010-05-26 22:51:20 0 d-----w- c:\program files\Market Me Tweet
2010-05-26 21:43:47 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2010-05-26 21:43:46 242896 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-05-26 21:43:40 216200 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-05-26 21:43:34 0 d-----w- c:\windows\system32\drivers\Avg
2010-05-26 21:41:30 0 d-----w- c:\program files\AVG
2010-05-26 21:41:15 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

==================== Find3M ====================

2010-06-07 15:44:30 81 ----a-w- C:\CTX.DAT
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2007-03-18 16:03:40 55026088 -c--a-w- c:\program files\tabers20_pc.exe
2007-03-18 15:35:41 13035264 -c--a-w- c:\program files\rxplanb_pc.exe
2007-03-18 15:23:51 15469552 -c--a-w- c:\program files\icd9cm_pc.exe
2007-03-18 15:14:35 10378568 -c--a-w- c:\program files\ferrica07_pc.exe
2006-05-03 05:54:22 22 -csha-w- c:\windows\sminst\HPCD.sys

============= FINISH: 14:11:44.53 ===============

It should be noted it took me four tries to get the gmer scan log you requested because my computer kept freezing. When I used ctr/alt/delete to try to get it working again, I saw the CPU was operating at 100% and then the screen would go black again. After three hard resets, I was able to get the log on the fourth try. I have not attached it here because I don't see where you have said to do so but I have it if you need it. I also have a jpg screen capture of what my CPU was doing before it froze last time.

I appreciate any enlightenment you can provide. Thank you.

Attached Files



BC AdBot (Login to Remove)

 


#2 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:55 AM

Posted 12 June 2010 - 06:57 AM

Hello dilemmaemma

Welcome to BleepingComputer smile.gif
==========================
Hi what files have you deleted?
Just because they are locked do not mean they are bad.

What issues are present now?

Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#3 dilemmaemma

dilemmaemma
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:55 AM

Posted 12 June 2010 - 11:31 AM

Thank you for your help Kahdah.

The files that are replicating in my Recycle Bin are labeled Dc7901 through Dc8118 and Dc8338. They are labeled as "Type: File Folder" They all say they are 0 bytes in size. They all say they are from "Origin: S-1-5-21-1457070501-80939802-263381294-1008" and they have origin dates from 2/11/2006 to 6/2/2010. If I try to permanently delete them from my recycle bin they will instead replicate at increased numbers. In other words, if I were to try to delete them now (which I won't) the next file would be named Dc8339 and so on. The only other file in my recycle bin is named "desktop.ini" It is labeled "Type: Configuration Settings" It says it is from the same origins as the other files (S-1-5-21-1457070501-80939802-263381294-1008). It is says it is 4.00 KB in size and that it was created June 8th, 2010.

These files were originally housed in my "Program Files\HP." After I did complete restore of my computer, my printer was not working properly so I reinstalled the software. My computer kept rejecting the new installation so I renamed the old file folder "Program Files\OldHP." After that I had no problem installing the printer software and it works fine. I was deleting this folder because I had replaced the old contents with the new installation.

Upon looking up this information for you I am also now noticing there are many files on my "C: drive" that are opened with "Unknown Application." They have several different extensions such as ".dbf" ".bak" ".fpt" ".fpk" and ".cdx" They were all created Thursday June 5th, 2008 at 2:14 AM. I do not know what these files are or whether this has any significance.

I am having the same issues that I was having during my original post as I have not used this computer since posting to this forum.

By the way, I won't be PM'ing you because I do not know what that means. Thanks again for your help.


#4 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:55 AM

Posted 12 June 2010 - 01:32 PM

It could be that you have file corruption.
The updates are normal since you have done a full restore then the updates that were previously applied will be trying to update with automatic updates.
Every time you turn off your computer they are scheduled to install.

For the recycle bin if it is corrupted this should fix it.
  • Copy the entire contents of the Quote Box below to Notepad.
  • Name the file as REMFoldr.bat
  • Change the Save as Type to All Files
  • and Save it on the desktop
  • Once saved, double click on the REMFoldr.bat. The computer will restart. That is normal.

QUOTE
@ECHO OFF
Echo Working ........
cd /d %~dp0
If Exist %systemdrive%\Recycler (
attrib -r -s -h %systemdrive%\Recycler /S /D
del /q %systemdrive%\Recycler
Rd /S /Q %systemdrive%\Recycler
)
If Exist %systemdrive%\Recycled (
attrib -r -s -h %systemdrive%\Recycled /S /D
del /q %systemdrive%\Recycled
Rd /S /Q %systemdrive%\Recycled
)
shutdown /r /t 0 /f


Upon re-start, see if the recycle bin is empty.

Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

#5 dilemmaemma

dilemmaemma
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:07:55 AM

Posted 18 June 2010 - 08:06 PM

Thank you for your assistance, kahdah. That solution did empty my recycle bin but my problems, as described in my original post, are much more than that. A friend has advised me to do a clean install of Windows 7 and that is the route I am going to try now because he also assures me my computer will be more efficient.

Thanks again for all your help. You can close this topic now as all the information in the logs will surely change once I attempt my upgrade installation.

#6 kahdah

kahdah

  • Security Colleague
  • 11,138 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Florida
  • Local time:07:55 AM

Posted 19 June 2010 - 06:38 AM

You are welcome smile.gif


Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. smile.gif

If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users