16 replies to this topic

[Pandut]

Out of the blue, Windows Security Center decided to spam my desktop with all sorts of crap like alert bubbles, auto-scans, pop-ups, and ads to purchase the full version. And when I try to configure it, all the options are grayed out and unselectable. It keeps trying to block me from going to the internet and it isn't appearing in the Add/Remove Programs. I tried to disable it via Administrator Tools but it's not working.

I know for a fact there is no virus/malware/spyware on my PC because this happened while I was in the middle of playing a game. I had AVG run scan, but it didn't find anything, I haven't downloaded/torrented anything for the past few days and my visits to the internet today have happened rarely. I've read online that this is Security Center's way of getting you to get the full version >>

Here's a HijackThis! logfile;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:16:50 PM, on 3/6/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\AVG\AVG9\avgemc.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Local Settings\Application Data\av.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url="http://www.ask.com/?o=15153&l=dis"]http://www.ask.com/?o=15153&l=dis[/url]
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: MultiShop v2.0 - {39AA6D29-4236-4F25-A36A-3410EF5283D9} - C:\PROGRA~1\PIVIMM~1\MULTIS~1.DLL
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: MultiShop v2.0 - {39AA6D29-4236-4F25-A36A-3410EF5283D9} - C:\PROGRA~1\PIVIMM~1\MULTIS~1.DLL
O9 - Extra 'Tools' menuitem: MultiShop v2.0 - {39AA6D29-4236-4F25-A36A-3410EF5283D9} - C:\PROGRA~1\PIVIMM~1\MULTIS~1.DLL
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 6062 bytes

[Dauth]

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

You know of multishop? Is it something you've installed.

Kill the two above, they are toolbars and toolbars = problems. The sooner the world learns this the better.

[BeefJeRKy]

The only toolbar I'd ever trust is the Google toolbar and nowadays search bars make it redundant.

[Kris]

Try scanning your PC with Avira Anti-vir and with Malwarebytes. From my experience, AVG sucks balls

Edited by Kris, 08 March 2010 - 18:29.

[Pandut]

Dauth, on 8 Mar 2010, 1:33, said:

O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

You know of multishop? Is it something you've installed.

Kill the two above, they are toolbars and toolbars = problems. The sooner the world learns this the better.

Killed those two and have no idea what multishop is.

Kris, on 8 Mar 2010, 11:28, said:

Try scanning your PC with Avira Anti-vir and with Malwarebytes. From my experience, AVG sucks balls

My uncle subscribed AVG to me, he said it works really well. But I'll try out those two you have suggested.

EDIT: Alright, big problem.

I can barely access my computer anymore. I can't install things, I can't remove things, hell I can barely access the internet now. An error message keeps popping up saying that it's been restricted and I don't have permission to use it. That, and I've noticed some stuff on my desktop have vanished....

EDIT2: I managed to get Malwarebytes installed via using 'Run as', then unchecking the protect privacy tab. It's doing a scan atm.

EDIT3: My brother thinks it's because my computer is getting old and senile; it's about 6-7 years.

Edited by Sobek, 08 March 2010 - 19:32.

[Libains]

IF you can do it, get Avast, install, and run a boot time scan (it's under the options of Scheduling scan). Real time scan on a PC is second best to this, all the time.

Also get the damn thing open, clear the thing of dust, check the internal temp, and just generally give the hardware some TLC. As to the age, more depends on the age of the components than the PC. What's the oldest crap you've got in there?

[Pandut]

AJ, on 8 Mar 2010, 13:48, said:

IF you can do it, get Avast, install, and run a boot time scan (it's under the options of Scheduling scan). Real time scan on a PC is second best to this, all the time.

I'll try after Malwarebytes is finished with the scan.

AJ, on 8 Mar 2010, 13:48, said:

Also get the damn thing open, clear the thing of dust, check the internal temp, and just generally give the hardware some TLC. As to the age, more depends on the age of the components than the PC. What's the oldest crap you've got in there?

Probably the Motherboard and the Hard-drive are the oldest of all, them both being the ones that came with the PC itself. I've been wanting to replace them but couldn't get enough funds to buy new parts, and getting a job is easier said then done.

My brother said something about this particular hard-drive using a cable/wire and that these types of hard-drives are no longer manufactured. Then he went on about other stuff that, to be honest, confused the crap out of me

[Crazykenny]

Looks like you got hit by a nasty virus. Solutions are already names for you. Boot-up scan is probably the best you can do.

[Pandut]

Hmm. I like Malwarebytes.

The scan is done, and it successfully removed six infected files from my PC. It restarted, and I noticed it booted up a lot faster and now everything seems to be back to normal. No pop-ups, no error messages. Nothing.

I'm still going to do a few scans and whatnot just to make sure.

[Libains]

I will recommend that when you have time, that you run a boot time scan using Avast, it is most likely to root out viruses BEFORE they run when the OS has booted up - makes them beatable, whereas once the oS has booted, the Viruses, even when deleted, can self-replicate and all the rest.

[BeefJeRKy]

If your HDD uses IDE (very wide cable), you could still get a SATA HDD either directly on your motherboard or with a PCI card.

[Pandut]

AJ, on 8 Mar 2010, 13:51, said:

I will recommend that when you have time, that you run a boot time scan using Avast, it is most likely to root out viruses BEFORE they run when the OS has booted up - makes them beatable, whereas once the oS has booted, the Viruses, even when deleted, can self-replicate and all the rest.

I've tried using Avast in the past - it kept pestering me with alerts to buy the full version >>

It worked well for the time I had it, but it just grew really annoying.

[Amdrial]

I'd say get the free non-commercial version then. I have it, and it hasn't bothered me about buying the "full" version once. I only have to re-register each year to make sure it keeps updating itself properly.

[Kris]

 

Sobek, on 9 Mar 2010, 3:03, said:

EDIT3: My brother thinks it's because my computer is getting old and senile; it's about 6-7 years.

BS, A well maintained PC in that age can still pretty much run with no problems.  My 4-5 years old PC still runs pretty much like it's still brand new.


As the others suggested, open up your case and inspect the inside of the case for dust buildup. Cleaning and Re-wiring (organizing the wires) the stuff inside pro-longs the lifespan of your computer. Be careful of static electricity though if you're cleaning the hardware inside..

Sobek, on 9 Mar 2010, 6:23, said:

AJ, on 8 Mar 2010, 13:51, said:

I will recommend that when you have time, that you run a boot time scan using Avast, it is most likely to root out viruses BEFORE they run when the OS has booted up - makes them beatable, whereas once the oS has booted, the Viruses, even when deleted, can self-replicate and all the rest.

I've tried using Avast in the past - it kept pestering me with alerts to buy the full version >>

It worked well for the time I had it, but it just grew really annoying.

The most recommended thing to do is TURN OFF SYSTEM RESTORE! From my nasty experience, it does more harm than good! Since it actually backs up copies of the viruses thus making the clean up alot harder.

After turning off System restore....Install avast! and run the Boot-time scan, Once successful, do a quick scan just to double check. After that, uninstall it and replace it with Avira Anti-vir and rescan everything. I still recommend Avira more than avast! due to the fact Avira have a small memory footprint compared to Avast! Memory sucking footprint and it has better detection rates .


After that, download CCleaner and run it's Registry cleaner to clear out any registries the virus left behind. Then, just run it's cleaning tool to completely wipe out temporary files and your browsing cache..

Once finished doing all those things, defragment your computer.  I recommend MyDefrag 4.2.9..

Reboot.

Edited by Kris, 09 March 2010 - 13:52.

[BeefJeRKy]

Avast 5 uses between 2 and 10MB of RAM for me. How much smaller do you want it to get? My phone has 448MB of RAM in fact. I'm sure your PC has more.

[Dauth]

I use defraggler to defrag. my avast consumes up to 100mb (all 7 services) but it does have 3.5gb to play with.

It is a well known and documented fact that computers run better if you format it roughly once every 12 months

[BeefJeRKy]

It's also a good idea to wipe the blank space in your HDD with a tool like CCleaner. This is because when you delete a file, its still physically there even though the system doesn't read it as such.