8 replies to this topic

[Tim K]

Hi, Just got a brand new e-machines computer yesterday. Tried to install the CD software for the DSL modem yesterday. It asked for my Administrator password and windows said it was wanting to send it in an unsecure manner. I pushed the reset button on the modem (Motorola Netopia 2267) and held it for 20 seconds, 15 sec. recommended it the book. This caused the Internet light to go solid red, an item the book says dosen't happen. Today I took the modem to the ISP and they said it was fine, that resetting it cleared all the ISP info and set it back to factory defaults. They reloaded all their info and they also said to toss the book and CD and just connect the DSL & ethernet cables, plug in, power up and hit the net. OK. Before doing this I did activate the 60 day trial of Norton Internet Security and the first thing I did when I connected to the net was get the updates for Norton which appeared to go just fine. Then I went to MSN.com, my homepage. As msn.com was loading it was VERY slow even hanging up a time or two. I didn't think too much of this since as soon as the Norton updated I started a complete system full scan. This scan found two tracking cookies, that's all. To be expected on a new machine. While looking at Application Status most were Good but some were Unproven in the list. I was clicking on the Unproven ones to see more info and some of them were for apps I knew like my Kodak printer, some were totally foreign and whe the window opened up they had very little info on them and some would do nothing when I clicked on Locate This File. Some that did show had Date Modified before the Date Created which I thought was odd. Some even had the same dates for Date Created, Date Modified and Accessed, we're talking dates like in 2008, 2009, and 2010 in all these places. One that did locate was Ho! with a carat above the "o". When I clicked on properties for this file it had very little info but did say the language was Chinese. On the Norton page that has the bar that shows Good in green, Unproven in gray, and Bad in red it had scanned 180,000 some files and had just about equal number of good and bad, 92,000 some good and 91,000 some bad which I thought was odd. It was also showing 9 internet hookups. Looking around I found in the History there were numerous first blocked then later allowed network connections to a Trecero Pseudo something (I'm not at that machine now). It appears that there is something making network connections and changes inthe background. This machine is fresh out of the box and has never had a usb flash drive connected and the only CD in it was the Kodak install disk and the Modem install disk. The only device connected is the Kodak printer. I looked at a file in the Files list in Norton called coIE.exe and when I clicked on Locate This File it took me there but then my Norton went out on the taskbar and the shortcuts to open it stopped working. Could there have been a virus in the modem ? Any help will be appreciated. I don't know what tools run on 7. Thanks, Tim K

[ken545]

Not sure whats going on, lets do this


Please download ATF Cleaner by Atribune to your desktop.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.






Please download Malwarebytes from Here or Here

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
  
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected .
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.

Post the report please





Download DDS from one of the links below to your desktop

Link 1
Link 2

• Double click the tool to run it.
• A black Screen will open, just read the contents and do nothing.
• When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
• Copy/Paste the contents of 'DDS.txt' into your post.
• 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

[Tim K]

Hi Ken, Thanks for the reply. I will run those tools and post logs tomorrow. Just another bit of info, today I tried to download and run the Norton Power Eraser. I clicked on the Download Now, got the File Download dialog box, clicked Save, selected save to Desktop, clicked Save. File downloaded in the File Download dialog box and completed but when I looked after the download completed it was not on the Desktop. Tried again and when I tried to save to Desktop a box popped up sayin the file already exists do you want to replace it ? Clicked yes and downloaded again, once more it was not on the Desktop. Today I also used a brand new USB thumb drive to get some files from a computer that is not online and hasn't been for years. These were Excel files. I did not copy them from the thumb drive to the new computer, rather opened the thumb drive and used the files with MS Office Starter which came on the machine, did what I needed to do saved & closed the files on the thumb drive. When I looked at Computer there was a new hard drive Q:\ Office Starter Click-To-Run (Protected). Tried to open it and take a look but access was denied while using the only Admin account on the machine. Also the Application Status in Norton Internet Security which shows the bar with the Green, Gray, and Red sections showing Good, Bad, Unproven number of files is all gray. I did notice once when I opened that screen they were colored for a split second then went gray. The file count is zero now when it was 180,000. The History in Norton shows multiple Network connections as well. Will send logs ASAP. Tim K

[ken545]

Good Morning Tim, Lets see what the scans find and if your problems are malware related and go from there.

[Tim K]

Hi Ken, Downloaded and ran the tools in the order listed. In ATF Cleaner the All Users Temp box was checked but the box and title were greyed out so as not to be able to change. When I installed MBAM when it first tried to update on opening I got this error message, "An error has occured. Please report this error to our support team. PROGRAM_ERROR_UPDATING (12007,0,WinHttpSendRequest)". After closing this window MBAM gave an outdated update prompt, clicked OK and was able to download 6.20MB of updates. Ran the quick scan. Downloaded DDS. On the first time after the download completed a window appeared very briefly sayin it was copying DDS from QW...... something, wasn't there long enough to read. Fearing the download was corrupted I redownloaded and saved it as DDS1 and did not see the "Copying" window. I clicked on the program to run it, the black screen came up as described and a window came up on top of it saying, "Windows Can't Open This File" FILE: PEV.DAT Do you want to : Use the web service to locate the program to open this file (checked) or select from a list of programs installed on this computer. Each time I clicked Cancel it would reappear after numerous clicks it went away for a few seconds and reappeared, after clicking Cancel a few more times it went away and the scan finished. One more note. From the quick look I took at the logs I saw no mention of the Q:\ drive I mentioned earlier, but it's still there. When you go to Computer and click the Q:\ shows up as Microsoft Office Click-to-Run 2010 (Protected) (Q:), however when you go to Computer when saving a file it shows up as Vir (Q:). There is a Program listed in Control Panel>Programs that is Microsoft Office Click-to-Run 2010 as well as Microsoft Office and Microsoft Office Starter 2010 - English. The logs are as follows: MBAM Log: Went to copy & past this log and it was gone. Had been saved to My Documents and is no longer there or in the MBAM logs. From what I saw it found nothing. DDS Log: . DDS (Ver_11-03-05.01) - NTFSx86 Run by Tim K at 10:10:52.08 on Tue 03/29/2011 Internet Explorer: 8.0.7600.16385 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.1791.877 [GMT -5:00] . AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} . ============== Running Processes =============== . svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Windows\system32\wuauclt.exe C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe svchost.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10i_ActiveX.exe C:\Users\Tim K\Desktop\dds1.scr C:\Windows\system32\conhost.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://emachines.msn.com uDefault_Page_URL = hxxp://emachines.msn.com mDefault_Page_URL = hxxp://emachines.msn.com mStart Page = hxxp://emachines.msn.com mLocal Page = c:\windows\syswow64\blank.htm mWinlogon: Userinit=userinit.exe BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files (x86)\norton internet security\engine\18.5.0.125\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files (x86)\norton internet security\engine\18.5.0.125\ips\IPSBHO.DLL BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files (x86)\norton internet security\engine\18.5.0.125\coIEPlg.dll mRun: [Norton Online Backup] c:\program files (x86)\symantec\norton online backup\NOBuClient.exe mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Hotkey Utility] c:\program files (x86)\emachines\hotkey utility\HotkeyUtility.exe mRun: [Conime] %windir%\system32\conime.exe mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\x64\3\EKIJ5000MUI.exe mRunOnce: [Malwarebytes' Anti-Malware] c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe /install /silent mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files (x86)\windows live\photo gallery\AlbumDownloadProtocolHandler.dll mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE mASetup: {89820200-ECBD-11cf-8B85-00AA005B4383} - c:\windows\syswow64\ie4uinit.exe -BaseSettings mASetup: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\windows\syswow64\rundll32.exe c:\windows\syswow64\mscories.dll,Install mASetup: >{26923b43-4d38-484f-9b9e-de460746276c} - c:\windows\syswow64\ie4uinit.exe -UserIconConfig mASetup: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "c:\windows\syswow64\rundll32.exe" "c:\windows\syswow64\iedkcs32.dll",BrandIEActiveSetup SIGNUP . ============= SERVICES / DRIVERS =============== . R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nisx64\1205000.07d\symds64.sys --> c:\windows\system32\drivers\nisx64\1205000.07d\SYMDS64.SYS [?] R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nisx64\1205000.07d\symefa64.sys --> c:\windows\system32\drivers\nisx64\1205000.07d\SYMEFA64.SYS [?] R1 BHDrvx64;BHDrvx64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.0.0.128\definitions\bashdefs\20110309.001\BHDrvx64.sys [2011-3-9 1124472] R1 IDSVia64;IDSVia64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.0.0.128\definitions\ipsdefs\20110325.001\IDSviA64.sys [2011-3-28 476792] R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nisx64\1205000.07d\ironx64.sys --> c:\windows\system32\drivers\nisx64\1205000.07d\Ironx64.SYS [?] R1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\nisx64\1205000.07d\symnets.sys --> c:\windows\system32\drivers\nisx64\1205000.07d\SYMNETS.SYS [?] R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2010-2-28 821664] R2 GREGService;GREGService;c:\program files (x86)\emachines\registration\GREGsvc.exe [2010-1-8 23584] R2 NIS;Norton Internet Security;c:\program files (x86)\norton internet security\engine\18.5.0.125\ccsvchst.exe [2011-3-25 130000] R2 NOBU;Norton Online Backup;c:\program files (x86)\symantec\norton online backup\NOBuAgent.exe [2010-6-1 2804568] R2 sftlist;Application Virtualization Client;c:\program files (x86)\microsoft application virtualization client\sftlist.exe [2010-4-24 483688] R2 Updater Service;Updater Service;c:\program files\emachines\emachines updater\UpdaterService.exe [2010-8-30 243232] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-3-25 132656] R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4925184] R3 Sftfs;Sftfs;c:\windows\system32\drivers\sftfslh.sys --> c:\windows\system32\drivers\Sftfslh.sys [?] R3 Sftplay;Sftplay;c:\windows\system32\drivers\sftplaylh.sys --> c:\windows\system32\drivers\Sftplaylh.sys [?] R3 Sftredir;Sftredir;c:\windows\system32\drivers\sftredirlh.sys --> c:\windows\system32\drivers\Sftredirlh.sys [?] R3 Sftvol;Sftvol;c:\windows\system32\drivers\sftvollh.sys --> c:\windows\system32\drivers\Sftvollh.sys [?] R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\microsoft application virtualization client\sftvsa.exe [2010-4-24 209768] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\kodak\aio\center\ekdiscovery.exe [2009-8-5 284016] S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\watadminsvc.exe --> c:\windows\system32\wat\WatAdminSvc.exe [?] S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . . ==================== Find3M ==================== . . ============= FINISH: 10:13:00.88 =============== Attach Log is attached. Good luck and happy hunting. One more item to mention. This machine has MS Silverlight installed, there is an update for Silverlight in Updates that when highlited gives no option to uninstall as do the others.It is Microsoft Silverlight 4.0.50917.0 Program is Microsoft Silverlight, no publisher listed. Also in Updates there are two others that list nothing under Publisher. They are KB958488 ( no other info) Install date 3-29-11 and Update For Microsoft Windows KB971033 also no publisher listed these both show Microsoft Windows as the Program. All updates below this one have install dates of 12-15-2010 and 8-30-2010. I first plugged this computer in on 3-24-2011. Hope this helps, Tim K

Attached Files

•  Attach3_28_11.zip   2.56KB   276 downloads

[ken545]

Hey

I am not looking at any infections on your log and you say Malwarebytes found nothing. The extras log is showing some errors with your hard disk controller and a few others. If this computer is only 5 days old it must be under warranty, I think I would give eMachines a call and see what they say.

I doubt you got infected in just 5 days but lets double check and scan for a rootkit, they hide and dont show up on most scanners

Download aswMBR.exe to your desktop.

Double click the aswMBR.exe to run it


Click the "Scan" button to start scan



On completion of the scan click save log, save it to your desktop and post in your next reply

[Tim K]

Hi Ken, Ran the aswMBR.exe as instructed. and here is the log. I know you may not see any signs of infection, but what created that Q: drive ? Also before coming here I tried to run some of the MS auto fixes and it wouldn't let me run them. I know without aq doubt that something is in here since my Malware Bytes has 2 uninstall files. One is the regular computer setup icon named unins000. In properties it says it was created, modified, and acessed today 4 hours ago, not so since I just looked at the Properties in the last 3 minutes. The other is an Office 2010 icon named unins000 says it's a MSG file. Properties says this one opens with Microsoft Office 2010 and the same with the dates and times in Properties. When I just looked at the second unins000 file I find yet a third one, unins000.dat. Properties says this one opens with Windows Shell Common Dll. I don't know, maybe my paranoia is running wild since I saw this machine starting to do some of the same things my seriously infested Compaq was doing. It appeared to have something in it that changed the policies and wouldn't allow even adminstrators to see things that were viewable before. Let me ask you this. Is IE5 necessary in Win7 ? During scans I have seen things in the IE5 Content\Temp folder, same was on the Compaq just jibberish named files like a group of caps letters in random order for file names and when you deleted them they came back. Found a couple of bizzare folders on here such as in Start>All Programs a folder called AUPEO! and another one, don't recall where, named Ho! with a carat over the "o". When checking the properties this files language was Chinese !!! Here is the log aswMBR version 0.9.4 Copyright© 2011 AVAST Software Run date: 2011-03-29 12:47:36 ----------------------------- 12:47:36.520 OS Version: Windows x64 6.1.7600 12:47:36.520 Number of processors: 2 586 0x603 12:47:36.520 ComputerName: WAREHOUSE-PC UserName: Warehouse 12:47:40.717 Initialize success 12:48:00.653 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005f 12:48:00.653 Disk 0 Vendor: Hitachi_ JP2O Size: 476940MB BusType: 3 12:48:02.713 Disk 0 MBR read successfully 12:48:02.713 Disk 0 MBR scan 12:48:02.728 Service scanning 12:48:03.914 Disk 0 trace - called modules: 12:48:03.945 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll nvstor64.sys 12:48:03.945 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80026de410] 12:48:03.961 3 CLASSPNP.SYS[fffff88001a5643f] -> nt!IofCallDriver -> [0xfffffa80021719b0] 12:48:03.961 5 ACPI.sys[fffff88000f2f781] -> nt!IofCallDriver -> \Device\0000005f[0xfffffa8002171060] 12:48:03.976 Scan finished successfully

[ken545]

Well Tim,

Its my feeling that this is just a plain old windows problem . I doubt eMachines sold you a infected computer but you need to get a hold of them and let them know whats going on.

You can also post in our windows forum for help, you can link them to this thread so they can see what we have done. They may be more familiar with whats going on with your system and can offer advice
http://forums.whatth...p?showforum=119

I will follow along and see what they advise

[ken545]

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatth...ed_t106388.html and start a new topic