Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Strange folders in Start Menu, keyboard problems, etc.


  • Please log in to reply
1 reply to this topic

#1 juneschi

juneschi

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:48 AM

Posted 15 August 2016 - 05:16 AM

Hi, for the past few days I've had a few problems with my computer. I'm 99% sure I'm infected. I'm in no way an advanced user but I tried to fix this by myself. This computer is falling apart, really, but I just want to get rid of this virus. Sorry if there is irrelevant info. Just wanted to provide as much detail as possible.

Using Windows 7 32-bit.

 

I was browsing a website and accidentally clicked on an URL, I closed it almost immediately though. I don't remember which URL is it but ever since then my PC has been acting strangely.

I ran Malwarebytes, TDSSKiller (found nothing) and other programs like SuperAntiSpyware. SAS found 591 tracking cookies, and since there were too many suspicious cookies I let SAS do its job and delete them. Spybot and ESET Online Scanner froze on me before the scans finished.

 

Firefox is working ok and I haven't tested Chrome yet but I don't think it has a problem either.

Malwarebytes found nothing major on my first scan (I had a browser hijacker called MyStartSearch before this started occurring, and I finally removed it yesterday) and I just did a second scan with Malwarebytes now and it found PUP.FastStart again (I deleted it).

There aren't any suspicious processes running (as far as I know).

 

Around two days ago, my keyboard was having some problems. When I typed "?" for example it would bring up }? instead, and some letters were randomly capitalised sometimes. It's now fixed; could have been a hardware problem.

I used a program I found here in BleepingComputer and it showed me that my HOSTS file has a few URLs related to malware/ad websites.

My Skype also got corrupted but that is probably unrelated. I had a power off problem.

I also got a BSOD: "KERNEL_DATA_INPAGE_ERROR". I think it's unrelated since it hasn't appeared again since I ran chkdsk.

 

The weirdest thing, however, is that, for example, whenever I search for something on my start menu (even the simplest of programs), a bunch of "folders" come up. They're named: "Programs", "Documents", "Files". When I click on any of them, a message appears, saying that I cannot open the file because of security settings (something like that). I googled the error message and it seems related to Internet Explorer. These "folders" have no metadata or icon and are 0 bytes. Windows tells me they're located in my Desktop but I can't find anything there. This is what bothers me the most because I can't search anything on Start Menu anymore.

 

No personal files have been deleted as far as I've noticed. My hard disk space has been fluctuating but I think that's normal. (A few megs disappearing and reappearing here and there, probably caused by temporarily files...)

I ran SAS's repair tools to see if I could fix my start menu and nothing happened.

 

 

Help?

 

UPDATE: I ran SAS again and it found a weird CLSID. It's called TRAYICON_HANDLER.OCX and the author is Robdogg, Inc. I found nothing on Google about this.


Edited by juneschi, 15 August 2016 - 05:57 AM.


BC AdBot (Login to Remove)

 


#2 Slurppa

Slurppa

  • Malware Study Hall Senior
  • 623 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:09:48 AM

Posted 15 August 2016 - 08:23 AM

Hi juneschi and Welcome to the Bleeping Computer!

Sorry to hear about your problems.
 

The weirdest thing, however, is that, for example, whenever I search for something on my start menu (even the simplest of programs), a bunch of "folders" come up. They're named: "Programs", "Documents", "Files"....

Have you updated your Windows? There have been some fixes related to these issues in the past
 
Windows 7 users can update via
Start menu > All Programs > Windows Update > Check for Updates (in left hand task panel).


Let's start by doing some scans:

:step1:
ZN3USrZ.png Emsisoft Emergency Kit
  • Click here to download Emsisoft Emergency Kit. The download will automatically start after a moment.
  • Save EmsisoftEmergencyKit.exe to your Desktop.
  • Double click on EmsisoftEmergencyKit.exe (Windows Vista/7/8 users: Accept UAC warning if it is enabled). A screen like this will appear:
    dQVDkTW.png
  • Leave everything as it is, then click Extract. This will unpack Emsisoft Emergency Kit to the EEK folder located in the root drive (usually C:\).
  • Once the extraction is done, an icon qwL1Upn.png will appear on your Desktop. Double click it to start Emsisoft Emergency Kit.
  • Wait for Emsisoft Emergency Kit to finish loading signatures. A screen like this should appear:
    yEgPemv.png
  • Choose Yes, then wait for EEK to finish updating.
  • Choose Malware Scan under the Scan button. When EEK asks to activate PUP detection, choose Yes.
  • Wait for the scan to finish.
    RUeRoi4.png
  • If EEK detects something, all detected items will be displayed. Place a checkmark before everything, then choose Quarantine Selected.
  • If Emsisoft Emergency Kit asks to reboot, please do so immediately.
  • The scan log is located in Logs -> Scan Logs. Click on the entry of the latest scan, choose Export and save the report on your Desktop.
    P7FSALs.png
  • Please Copy and Paste the contents of the scan log in your next reply.
 

:step2:
Please download MiniToolBox, save it to your desktop and run it.
Checkmark the following checkboxes:
  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices
  • List Users, Partitions and Memory size.
  • List Minidump Files
  • List Restore Points
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.

Note: When using "Reset FF Proxy Settings" option Firefox should be closed.


@EDIT Modified markup.

Edited by Slurppa, 15 August 2016 - 08:27 AM.

Member of the Bleeping Computer A.I.I. early response team!





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users