d3m0l1sh3r
Topic Starter
Okay, I'm running an Acer desktop, 2GB RAM, 320 GB HDD, Windows Vista (Home/Premium?), and i believe i just got hit with something hard.
Originally, i cut the power, put in the Ubuntu Disc, and was prepared to go that way, but it was taking too much to trouble to get online, install ClamAV, etc.
So i just went back to regular vista. (In case of Conficker =]])
Comodo Firewall kept popping up my SUPER (video converter, safe, by eRight Soft) as being a virus, on like every file in the program
"Heur.Pck.tElock", I looked this up on google, linked me to Comodo's forums saying a false positive in multiple threads.
I Uninstalled SUPER, deleted all files, restarted.
I just ran Ccleaner, deleted 7gigs of stuff and fixed a few reg errors.
AcerGameConsole.exe, which has never been a problem before popped up, "Heur.Pck.Molebox", which i looked up, had a low risk assessment.
Random .exe files began being detected as "ApplicUnsaf.Win32.Hide.~AB@833268", and when i told it to "Remove" or "Quarantine", they werent there. A trojan process was detected, "Bootmatrix.exe" i terminated and checked to be sure it wasn't in startup.
Some flash drives that were in the computer i moved to my laptop, and they were completely infected as in files, autoruns, etc, luckily removed and detected by the expired McAffee on the laptop. i Reformatted those immediately.
Phew…
(Honestly, i just updated to a new version of Comodo, so it may have some new Heuristics features that are just being annoying, and there not be anything at all, but i need to be sure.)
Comodo seemed to have frozen its database update, so i ran SUPERAntiSpyware Free Edition, its scanning, but i believe Comodo just started its self now. >.<
I guess, here's the HijackThis! log (Scan & Save a logfile, right?)…
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:14, on 2/19/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\COMODO\SafeSurf\cssurf.exe
C:\Program Files\COMODO\COMODO Internet Security\cfp.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
L:\PortableApps\ComputerRepairUtility\Virus Removal\SuperAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\CD Art Display\CAD.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\TRENDware\TEW444UB\ACU.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
L:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
C:\Program Files\Pidgin\pidgin.exe
L:\PortableApps\ComputerRepairUtility\Launcher.exe
L:\PortableApps\ComputerRepairUtility\Virus Removal\HijackThis.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\DllHost.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
–
End of file - 1558 bytes
As of right now, nothing has been detected in the scans.
Let me know if you need more info.
Thanks so much
