Problems with computer.

[le3t]

This one day my friend on RS told me to go on his guy so he can transfer money buy selling stuff to his main. the next day i tried go on the computer but it was so slow, so i scanned and it said "0 objects scanned" and then it showed 3 viruses that i could not delete because the avg scan did not end, even though i left it on for 23 hours.

 

and when i turn on my comp its usually slow, it freezes when i have more then 3 stuff at one time.

 

 

 

Any help on fixing my comp right now?

[Da Pirates]

Post an HJT log.

[D. V. Devnull]

le3t, I can say that whatever happened was NOT due to the RS Applet. It is more than likely, however, that if you did not have the RS adverts blocked that you may have picked up a virus (or three) on your computer. :(

 

 

 

Now that you're infected, good luck removing them, because they sound like they've been rigged to stop any attempts to kill them. :|

 

 

 

(BTW, that HJT log, if you can get one, might still help.)

 

 

 

~D. V. Devnull

[urbestfreind]

HJT be here.

 

 

 

Go here too. Small test forum I made, with a bit on malware. Thought you may find it good to help with your problem.

 

 

 

Figured I would throw out a link to a dl. Be sure to just save the log when you're done, then copy it and paste it here (in hide tags of course).

[VARN]

le3t, I can say that whatever happened was NOT due to the RS Applet. It is more than likely, however, that if you did not have the RS adverts blocked that you may have picked up a virus (or three) on your computer. :(

 

 

 

Now that you're infected, good luck removing them, because they sound like they've been rigged to stop any attempts to kill them. :|

 

 

 

(BTW, that HJT log, if you can get one, might still help.)

 

 

 

~D. V. Devnull

 

 

 

RS adverts can give you a virus?

[Nadril]

le3t, I can say that whatever happened was NOT due to the RS Applet. It is more than likely, however, that if you did not have the RS adverts blocked that you may have picked up a virus (or three) on your computer. :(

 

 

 

Now that you're infected, good luck removing them, because they sound like they've been rigged to stop any attempts to kill them. :|

 

 

 

(BTW, that HJT log, if you can get one, might still help.)

 

 

 

~D. V. Devnull

 

 

 

RS adverts can give you a virus?

 

 

 

Very unlikely. I wouldn't take advise from D.V. Either way, post a HJT log.

[le3t]

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

 

O2 - BHO: (no name) - {0493A2CA-7954-4F1A-B1DF-6AF75506C91A} - C:\WINDOWS\system32\tuvTkkIC.dll (file missing)

 

O2 - BHO: (no name) - {2FC2D70F-3B4C-4380-883B-A4E98A67A98A} - C:\WINDOWS\system32\cbXqqRHW.dll (file missing)

 

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

 

O2 - BHO: (no name) - {6BC03760-586E-4D52-9FCA-B4AC1415BF16} - C:\WINDOWS\system32\nnnmNhec.dll (file missing)

 

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

 

O2 - BHO: (no name) - {84A46358-4001-4E42-A966-A3CAC5F91716} - C:\WINDOWS\system32\rqRLcCur.dll (file missing)

 

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

 

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

 

O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

 

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)

 

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll (file missing)

 

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

 

O2 - BHO: {8fe03de3-27ab-083a-c214-0224d3fb282f} - {f282bf3d-4220-412c-a380-ba723ed30ef8} - C:\WINDOWS\system32\xwirid.dll

 

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll

 

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

 

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)

 

O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL

 

O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher[Caution: Executable File]

 

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG[Caution: Executable File]" /Spoil /RemAdvDef /Migration32

 

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst[Caution: Executable File] /SYNC

 

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: Executable File] /SYNC

 

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP[Caution: Executable File] /IMEName

 

O4 - HKLM\..\Run: [WireLessMouse ] C:\Program Files\Multimedia Combo Set\MouseDrv[Caution: Executable File]

 

O4 - HKLM\..\Run: [WireLessKeyboard ] C:\Program Files\Multimedia Combo Set\PS2USBKbdDrv[Caution: Executable File]

 

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm[Caution: Executable File] -startup

 

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch[Caution: Executable File]" -start

 

O4 - HKLM\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm[Caution: Executable File]" -scheduler

 

O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16

 

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

 

O4 - HKLM\..\Run: [{2F-F2-2F-FA-DW}] c:\windows\system32\jjwnw64p[Caution: Executable File] DWram

 

O4 - HKLM\..\Run: [{64905498-7f84-c50e-def9-f0fe9e86793d}] C:\WINDOWS\System32\Rundll32[Caution: Executable File] "C:\WINDOWS\system32\ihotrxgpgd.dll" DllStart

 

O4 - HKLM\..\Run: [4202f255] rundll32[Caution: Executable File] "C:\WINDOWS\system32\bsesgqvc.dll",b

 

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray[Caution: Executable File]

 

O4 - HKLM\..\Run: [bM4131c1c9] Rundll32[Caution: Executable File] "C:\WINDOWS\system32\rywxqcfh.dll",s

 

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched[Caution: Executable File]"

 

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: Executable File]" /background

 

O4 - HKCU\..\Run: [ctfmon[Caution: Executable File]] C:\WINDOWS\system32\ctfmon[Caution: Executable File]

 

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier[Caution: Executable File]

 

O4 - HKCU\..\Run: [speedRunner] C:\Documents and Settings\Compaq_Owner\Application Data\SpeedRunner\SpeedRunner[Caution: Executable File]

 

O4 - HKCU\..\Run: [AbyssWebServer] C:\Program Files\Abyss web server\abyssws[Caution: Executable File]

 

O4 - HKCU\..\Run: [sVCHOST[Caution: Executable File]] C:\WINDOWS\system32\drivers\svchost[Caution: Executable File]

 

O4 - Startup: client.jar

 

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll

 

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll

 

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate[Caution: Executable File]

 

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b31267.cab

 

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab

 

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/ms ... b56986.cab

 

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/Mi ... b31267.cab

 

O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://www.nexon.co.jp/JP/f/ActiveX/Public/nxpm.cab

 

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan ... stubie.cab

 

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/ ... .7.109.cab

 

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab

 

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b31267.cab

 

O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedow ... in7USA.cab

 

O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} - http://update.videoegg.com/Install/Wind ... lisher[Caution: Executable File]

 

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMe ... loader.cab

 

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v ... b56649.cab

 

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Me ... b56907.cab

 

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab

 

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/So ... b31267.cab

 

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

 

O20 - AppInit_DLLs: avgrsstx.dll

 

O20 - Winlogon Notify: nnnmNhec - nnnmNhec.dll (file missing)

 

O20 - Winlogon Notify: rqRLcCur - rqRLcCur.dll (file missing)

 

O21 - SSODL: rdihost - {1391DEBC-BE92-4F1E-9955-F294A2A5FC94} - rdihost.dll (file missing)

 

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx[Caution: Executable File]

 

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc[Caution: Executable File]

 

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc[Caution: Executable File]

 

O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\anVsaWUgbGFtYmVydA\command[Caution: Executable File] (file missing)

 

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService[Caution: Executable File]

 

O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon[Caution: Executable File] (file missing)

 

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService[Caution: Executable File]

 

O24 - Desktop Component 0: (no name) - http://www.gamebrew.com/images/layout/gamebrew_grid.gif

 

 

 

--

 

End of file - 9744 bytes

 

[Jernlov]

It looks clean from what I can see. I'll double check it later just to be sure.

 

 

 

Lots of toolbars and crap that you've got installed though.

[D. V. Devnull]

le3t, I can say that whatever happened was NOT due to the RS Applet. It is more than likely, however, that if you did not have the RS adverts blocked that you may have picked up a virus (or three) on your computer. :(

 

 

 

Now that you're infected, good luck removing them, because they sound like they've been rigged to stop any attempts to kill them. :|

 

 

 

(BTW, that HJT log, if you can get one, might still help.)

RS adverts can give you a virus?

Very unlikely. I wouldn't take advise from D.V. Either way, post a HJT log.

Nadril, you haven't seen a PC drag to a halt while trying to run the RS Game Applet while the Advert Server wasn't blocked, have you? You haven't seen your antivirus go off while playing on RuneScape, with nothing else loaded (and knowing your PC happens to be clean) and telling you that your PC is pulling down an infected file, which you're (at that point) certain that is being triggered by the advert frame, have you? Sadly, I've had the luck of seeing all of that, and I have to say, I was rather irate... (I'd show you the [bleep] log, but the system admin here keeps things to only about 3-4 months, and the incident is older, so it was 'pruned off' already.) I would like to hope that Jagex has possibly revised their Advert-handling/Advert-serving strategies, but I suspect they have not.

 

 

 

Also, do you notice it was ONLY after having been on RuneScape (without the grade of blocks I now have in place) that le3t's PC was infected? Now, I'll admit I'm making the minor assumption of le3t having not gone wandering off to the fringes of the web, given as they sound like a total newbie. But knowing that the Java Applet NEVER has a virus in it, which means that you can't be infected by logging into someone's RS account... That means the only remaining way is through RuneScape's Advertisements, unless they did go wandering off into some bad spot. :ugeek:

 

 

 

 

 

To which, I'm now left with these questions... le3t, did you only go to the RuneScape website on the day that your PC became infected? If you did go to other sites, which ones? (Some of us around here know where to stay clear of without a proper filter, and can tell you if any of those sites you went to are 'certified trouble'...) And BTW, you've got a lot of awful spaghetti in your HJT log... :-s

 

 

 

~D. V. Devnull

[pryomancer]

I find it incredibly unlikely that there would be a virus in JaGEx adverts. In fact, can one even get a virus from an advert which has not been clicked on, and has remained idle in the page?

 

 

 

Even if you can, RuneScape is aimed at kids, and the last thing they want to do is get their site black listed because it 'contains viruses'. A lot of parents will block a site if it even mentions the word 'virus', and it makes no sense for JaGEx to be lax about which adverts they allow to be displayed.

[D. V. Devnull]

In fact, can one even get a virus from an advert which has not been clicked on, and has remained idle in the page?

Sadly, yes. I've tripped over articles about it happening, and almost been hit by more than one. (In case you're also curious, it was due to pages that are normally innocent, having been hacked/changed somehow to contain viral code, and/or triggers to download such.) They're called "Drive-By Attacks"... :(

 

 

 

Even if you can, RuneScape is aimed at kids, and the last thing they want to do is get their site black listed because it 'contains viruses'. A lot of parents will block a site if it even mentions the word 'virus', and it makes no sense for JaGEx to be lax about which adverts they allow to be displayed.

Please, tell that to Jagex? I think they should preview adverts before they allow the showing of them to the general public. :?

 

 

 

~D. V. "stuck on mental overload" Devnull

[InkofDeath]

Maybe you have too many anti-virus or anti-malware protectors or whatever running at the same time, or programs you've downloaded are just being labeled as viruses.

[D. V. Devnull]

Maybe you have too many anti-virus or anti-malware protectors or whatever running at the same time, or programs you've downloaded are just being labeled as viruses.

 

What, me? I'm not having that problem at all. :)

 

 

 

As for the opening poster, neither are they... In fact, it looks to me like they don't even have a firewall running, now that I really noticed it... No wonder they've been hit. That rules out any local processes right there, unless what happened was triggered by one of them. (Which I could almost bet on, if it weren't for the missing firewall.) :o

 

 

 

~D. V. Devnull

[tryto]

RS records the last IP logged onto your account. If the OP had logged onto someone else's account, then they logged on, they could find his IP, and if he's not running a firewall, that could be bad :P.

[chris1216]

Easy solution:

 

 

 

Step 1: Wait for Devnull to post

 

Step 2: Carefully examine what Devnull says

 

Step 3: Find someone that completely disagrees with Devnull

 

Step 4: Do what that second person tells you to do.

 

 

 

Pretty much works all the time.

[D. V. Devnull]

Easy solution:

 

 

 

Step 1: Wait for Devnull to post

 

Step 2: Carefully examine what Devnull says

 

Step 3: Find someone that completely disagrees with Devnull

 

Step 4: Do what that second person tells you to do.

 

 

 

Pretty much works all the time.

 

Of course, if I have actually found the problem, then disagreeing with me is a bad idea. Or maybe you didn't realize that? :P

 

 

 

<*walks off, laughing loudly*> :lol:

 

 

 

~D. V. Devnull

[VARN]

SDFix says it will remove SpeedRunner[Caution: Executable File] for you. Just follow the instructions on the page.

[Nadril]

Easy solution:

 

 

 

Step 1: Wait for Devnull to post

 

Step 2: Carefully examine what Devnull says

 

Step 3: Find someone that completely disagrees with Devnull

 

Step 4: Do what that second person tells you to do.

 

 

 

Pretty much works all the time.

 

Of course, if I have actually found the problem, then disagreeing with me is a bad idea. Or maybe you didn't realize that? :P

 

 

 

<*walks off, laughing loudly*> :lol:

 

 

 

~D. V. Devnull

 

 

 

I don't think we have to worry about that...

 

 

 

 

 

RS records the last IP logged onto your account. If the OP had logged onto someone else's account, then they logged on, they could find his IP, and if he's not running a firewall, that could be bad

 

 

 

This is actually a very good point, I didn't even think about that being a possibility.

[le3t]

Any ideas on how to delete these viruses?

 

 

 

when i scan with AVG it says "0 objects scanned"

 

and it never ends...

[OldJoe]

Boot up in safe-mode and scan again.

 

 

 

You could also try uninstalling Avg and installing Avast or Avira and see if they work better (funny that those 3 have free versions and all begin with an a).

 

Panda (which is a pay product) has a 1 month free trial of their internet security 2009 version ( http://www.pandasecurity.com/homeusers/ ... N-IS09-DWN ) which you could also try out. I don't know if Norton/F-Secure or Kaspersky also got one month trial, but you could check them and see if they have.

[Sbrideau]

Boot up in safe-mode and scan again.

 

 

 

You could also try uninstalling Avg and installing Avast or Avira and see if they work better (funny that those 3 have free versions and all begin with an a).

 

Panda (which is a pay product) has a 1 month free trial of their internet security 2009 version ( http://www.pandasecurity.com/homeusers/ ... N-IS09-DWN ) which you could also try out. I don't know if Norton/F-Secure or Kaspersky also got one month trial, but you could check them and see if they have.

 

 

 

I can already say that Kaspersky does. I wouldn't even try Norton though, even if they have a 30 days trial, all it's gonna do is freeze the machine, if it's already slow, and you add something taking so much juice.

[D. V. Devnull]

Boot up in safe-mode and scan again.

 

 

 

You could also try uninstalling Avg and installing Avast or Avira and see if they work better (funny that those 3 have free versions and all begin with an a).

 

Panda (which is a pay product) has a 1 month free trial of their internet security 2009 version ( http://www.pandasecurity.com/homeusers/ ... N-IS09-DWN ) which you could also try out. I don't know if Norton/F-Secure or Kaspersky also got one month trial, but you could check them and see if they have.

I can already say that Kaspersky does. I wouldn't even try Norton though, even if they have a 30 days trial, all it's gonna do is freeze the machine, if it's already slow, and you add something taking so much juice.

I'll concur with sbrideau about Norton, especially since I've witnessed firsthand how much that AV sucks up....... BTW, don't forget Eset's NOD32! From what I remember, they have a 1-month trial also... :-k ... So if all else fails, it is at least worth trying. 8-)

 

 

 

(Also, from what I understand, the update feature is the only thing on NOD32 that disables after the trial is over, allowing your PC to stay at least protected while you decide what you wish to do.)

 

 

 

~D. V. Devnull