Hi,
Just got a brand new e-machines computer yesterday. Tried to install the CD software for the DSL modem yesterday. It asked for my Administrator password and windows said it was wanting to send it in an unsecure manner. I pushed the reset button on the modem (Motorola Netopia 2267) and held it for 20 seconds, 15 sec. recommended it the book. This caused the Internet light to go solid red, an item the book says dosen't happen. Today I took the modem to the ISP and they said it was fine, that resetting it cleared all the ISP info and set it back to factory defaults. They reloaded all their info and they also said to toss the book and CD and just connect the DSL & ethernet cables, plug in, power up and hit the net. OK.
Before doing this I did activate the 60 day trial of Norton Internet Security and the first thing I did when I connected to the net was get the updates for Norton which appeared to go just fine. Then I went to MSN.com, my homepage. As msn.com was loading it was VERY slow even hanging up a time or two. I didn't think too much of this since as soon as the Norton updated I started a complete system full scan. This scan found two tracking cookies, that's all. To be expected on a new machine.
While looking at Application Status most were Good but some were Unproven in the list. I was clicking on the Unproven ones to see more info and some of them were for apps I knew like my Kodak printer, some were totally foreign and whe the window opened up they had very little info on them and some would do nothing when I clicked on Locate This File. Some that did show had Date Modified before the Date Created which I thought was odd. Some even had the same dates for Date Created, Date Modified and Accessed, we're talking dates like in 2008, 2009, and 2010 in all these places. One that did locate was Ho! with a carat above the "o". When I clicked on properties for this file it had very little info but did say the language was Chinese.
On the Norton page that has the bar that shows Good in green, Unproven in gray, and Bad in red it had scanned 180,000 some files and had just about equal number of good and bad, 92,000 some good and 91,000 some bad which I thought was odd. It was also showing 9 internet hookups. Looking around I found in the History there were numerous first blocked then later allowed network connections to a Trecero Pseudo something (I'm not at that machine now). It appears that there is something making network connections and changes inthe background. This machine is fresh out of the box and has never had a usb flash drive connected and the only CD in it was the Kodak install disk and the Modem install disk. The only device connected is the Kodak printer. I looked at a file in the Files list in Norton called coIE.exe and when I clicked on Locate This File it took me there but then my Norton went out on the taskbar and the shortcuts to open it stopped working. Could there have been a virus in the modem ?
Any help will be appreciated. I don't know what tools run on 7.
Thanks,
Tim K
Please download ATF Cleaner by Atribune to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.
Please download Malwarebytes from Here or Here
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan. [external image: Posted Image]
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report please
Download DDS from one of the links below to your desktop
Link 1 Link 2
Double click the tool to run it.
A black Screen will open, just read the contents and do nothing.
When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
Copy/Paste the contents of 'DDS.txt' into your post.
'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)
Hi Ken,
Thanks for the reply. I will run those tools and post logs tomorrow. Just another bit of info, today I tried to download and run the Norton Power Eraser. I clicked on the Download Now, got the File Download dialog box, clicked Save, selected save to Desktop, clicked Save. File downloaded in the File Download dialog box and completed but when I looked after the download completed it was not on the Desktop. Tried again and when I tried to save to Desktop a box popped up sayin the file already exists do you want to replace it ? Clicked yes and downloaded again, once more it was not on the Desktop.
Today I also used a brand new USB thumb drive to get some files from a computer that is not online and hasn't been for years. These were Excel files. I did not copy them from the thumb drive to the new computer, rather opened the thumb drive and used the files with MS Office Starter which came on the machine, did what I needed to do saved & closed the files on the thumb drive. When I looked at Computer there was a new hard drive Q:\ Office Starter Click-To-Run (Protected). Tried to open it and take a look but access was denied while using the only Admin account on the machine. Also the Application Status in Norton Internet Security which shows the bar with the Green, Gray, and Red sections showing Good, Bad, Unproven number of files is all gray. I did notice once when I opened that screen they were colored for a split second then went gray. The file count is zero now when it was 180,000. The History in Norton shows multiple Network connections as well.
Will send logs ASAP.
Tim K
Hi Ken,
Downloaded and ran the tools in the order listed. In ATF Cleaner the All Users Temp box was checked but the box and title were greyed out so as not to be able to change.
When I installed MBAM when it first tried to update on opening I got this error message, "An error has occured. Please report this error to our support team. PROGRAM_ERROR_UPDATING (12007,0,WinHttpSendRequest)". After closing this window MBAM gave an outdated update prompt, clicked OK and was able to download 6.20MB of updates. Ran the quick scan.
Downloaded DDS. On the first time after the download completed a window appeared very briefly sayin it was copying DDS from QW…… something, wasn't there long enough to read. Fearing the download was corrupted I redownloaded and saved it as DDS1 and did not see the "Copying" window. I clicked on the program to run it, the black screen came up as described and a window came up on top of it saying, "Windows Can't Open This File" FILE: PEV.DAT Do you want to : Use the web service to locate the program to open this file (checked) or select from a list of programs installed on this computer. Each time I clicked Cancel it would reappear after numerous clicks it went away for a few seconds and reappeared, after clicking Cancel a few more times it went away and the scan finished.
One more note. From the quick look I took at the logs I saw no mention of the Q:\ drive I mentioned earlier, but it's still there. When you go to Computer and click the Q:\ shows up as Microsoft Office Click-to-Run 2010 (Protected) (Q:), however when you go to Computer when saving a file it shows up as Vir (Q:). There is a Program listed in Control Panel>Programs that is Microsoft Office Click-to-Run 2010 as well as Microsoft Office and Microsoft Office Starter 2010 - English.
The logs are as follows:
MBAM Log:
Went to copy & past this log and it was gone. Had been saved to My Documents and is no longer there or in the MBAM logs. From what I saw it found nothing.
DDS Log:
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 10:10:52.08 on Tue 03/29/2011
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.1791.877 [GMT -5:00]
.
AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
.
============== Running Processes ===============
.
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe
C:\Program Files (x86)\eMachines\Hotkey Utility\HotkeyUtility.exe
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe
C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
svchost.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10i_ActiveX.exe
C:\Users\Tim K\Desktop\dds1.scr
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://emachines.msn.com
uDefault_Page_URL = hxxp://emachines.msn.com
mDefault_Page_URL = hxxp://emachines.msn.com
mStart Page = hxxp://emachines.msn.com
mLocal Page = c:\windows\syswow64\blank.htm
mWinlogon: Userinit=userinit.exe
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files (x86)\norton internet security\engine\18.5.0.125\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files (x86)\norton internet security\engine\18.5.0.125\ips\IPSBHO.DLL
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files (x86)\norton internet security\engine\18.5.0.125\coIEPlg.dll
mRun: [Norton Online Backup] c:\program files (x86)\symantec\norton online backup\NOBuClient.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files (x86)\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Hotkey Utility] c:\program files (x86)\emachines\hotkey utility\HotkeyUtility.exe
mRun: [Conime] %windir%\system32\conime.exe
mRun: [EKIJ5000StatusMonitor] c:\windows\system32\spool\drivers\x64\3\EKIJ5000MUI.exe
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files (x86)\malwarebytes' anti-malware\mbamgui.exe /install /silent
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files (x86)\windows live\writer\WriterBrowserExtension.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files (x86)\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
mASetup: {89820200-ECBD-11cf-8B85-00AA005B4383} - c:\windows\syswow64\ie4uinit.exe -BaseSettings
mASetup: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\windows\syswow64\rundll32.exe c:\windows\syswow64\mscories.dll,Install
mASetup: >{26923b43-4d38-484f-9b9e-de460746276c} - c:\windows\syswow64\ie4uinit.exe -UserIconConfig
mASetup: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "c:\windows\syswow64\rundll32.exe" "c:\windows\syswow64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
============= SERVICES / DRIVERS ===============
.
R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nisx64\1205000.07d\symds64.sys –> c:\windows\system32\drivers\nisx64\1205000.07d\SYMDS64.SYS [?]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nisx64\1205000.07d\symefa64.sys –> c:\windows\system32\drivers\nisx64\1205000.07d\SYMEFA64.SYS [?]
R1 BHDrvx64;BHDrvx64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.0.0.128\definitions\bashdefs\20110309.001\BHDrvx64.sys [2011-3-9 1124472]
R1 IDSVia64;IDSVia64;c:\programdata\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nis_18.0.0.128\definitions\ipsdefs\20110325.001\IDSviA64.sys [2011-3-28 476792]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nisx64\1205000.07d\ironx64.sys –> c:\windows\system32\drivers\nisx64\1205000.07d\Ironx64.SYS [?]
R1 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\nisx64\1205000.07d\symnets.sys –> c:\windows\system32\drivers\nisx64\1205000.07d\SYMNETS.SYS [?]
R2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\common files\microsoft shared\virtualization handler\CVHSVC.EXE [2010-2-28 821664]
R2 GREGService;GREGService;c:\program files (x86)\emachines\registration\GREGsvc.exe [2010-1-8 23584]
R2 NIS;Norton Internet Security;c:\program files (x86)\norton internet security\engine\18.5.0.125\ccsvchst.exe [2011-3-25 130000]
R2 NOBU;Norton Online Backup;c:\program files (x86)\symantec\norton online backup\NOBuAgent.exe [2010-6-1 2804568]
R2 sftlist;Application Virtualization Client;c:\program files (x86)\microsoft application virtualization client\sftlist.exe [2010-4-24 483688]
R2 Updater Service;Updater Service;c:\program files\emachines\emachines updater\UpdaterService.exe [2010-8-30 243232]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-3-25 132656]
R3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4925184]
R3 Sftfs;Sftfs;c:\windows\system32\drivers\sftfslh.sys –> c:\windows\system32\drivers\Sftfslh.sys [?]
R3 Sftplay;Sftplay;c:\windows\system32\drivers\sftplaylh.sys –> c:\windows\system32\drivers\Sftplaylh.sys [?]
R3 Sftredir;Sftredir;c:\windows\system32\drivers\sftredirlh.sys –> c:\windows\system32\drivers\Sftredirlh.sys [?]
R3 Sftvol;Sftvol;c:\windows\system32\drivers\sftvollh.sys –> c:\windows\system32\drivers\Sftvollh.sys [?]
R3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\microsoft application virtualization client\sftvsa.exe [2010-4-24 209768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files (x86)\kodak\aio\center\ekdiscovery.exe [2009-8-5 284016]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\watadminsvc.exe –> c:\windows\system32\wat\WatAdminSvc.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 57184]
.
=============== Created Last 30 ================
.
.
==================== Find3M ====================
.
.
============= FINISH: 10:13:00.88 ===============
Attach Log is attached.
Good luck and happy hunting. One more item to mention. This machine has MS Silverlight installed, there is an update for Silverlight in Updates that when highlited gives no option to uninstall as do the others.It is Microsoft Silverlight 4.0.50917.0 Program is Microsoft Silverlight, no publisher listed. Also in Updates there are two others that list nothing under Publisher. They are KB958488 ( no other info) Install date 3-29-11 and Update For Microsoft Windows KB971033 also no publisher listed these both show Microsoft Windows as the Program. All updates below this one have install dates of 12-15-2010 and 8-30-2010. I first plugged this computer in on 3-24-2011.
Hope this helps,
Tim K
I am not looking at any infections on your log and you say Malwarebytes found nothing. The extras log is showing some errors with your hard disk controller and a few others. If this computer is only 5 days old it must be under warranty, I think I would give eMachines a call and see what they say.
I doubt you got infected in just 5 days but lets double check and scan for a rootkit, they hide and dont show up on most scanners
Download aswMBR.exe to your desktop.
Double click the aswMBR.exe to run it
[external image: Posted Image]
Click the "Scan" button to start scan
[external image: Posted Image]
On completion of the scan click save log, save it to your desktop and post in your next reply
Its my feeling that this is just a plain old windows problem . I doubt eMachines sold you a infected computer but you need to get a hold of them and let them know whats going on.
You can also post in our windows forum for help, you can link them to this thread so they can see what we have done. They may be more familiar with whats going on with your system and can offer advice http://forums.whatthetech.com/index.php?showforum=119
