Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Am I Infected?

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Am I Infected?

Unread postby chettyharish » May 14th, 2009, 2:16 am

Am I Infected? My Comodo is blocking the following things and my net is not working good
And I AM getting A Blue Screen Which I cant read cause the computer restarts after that this is the first time in 2yrs with this pc I believe this happened after windows update or my nvidia graphics update plz help

203.94.243.70 this ip is my internet service provider
192.168.1.3 no info about this ip

COMODO Internet Security Logs

5/14/2009 4:45:37 AM Windows Operating System Blocked 203.94.243.70 53 192.168.1.3 52274 UDP
5/14/2009 12:05:37 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 51693 UDP
5/14/2009 12:06:13 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 57852 UDP
End of The Report



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:34 AM, on 5/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter.exe
C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\AllToTray\ALLTOTRAY.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Launchy\Launchy.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\downloads\office2007sp2-kb953195-fullfile-en-us.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;localhost
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\siteadvisor\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [ShaPlus Bandwidth Meter] "C:\Program Files\ShaPlus Bandwidth Meter\ShaPlus Bandwidth Meter" /s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Taskbar Shuffle] C:\Program Files\Taskbar Shuffle\taskbarshuffle.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AllToTray] C:\Program Files\AllToTray\ALLTOTRAY.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O4 - Global Startup: AutorunsDisabled
O4 - Global Startup: Launchy.lnk = C:\Program Files\Launchy\Launchy.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan ... stubie.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 9336993935
O16 - DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - http://h20264.www2.hp.com/ediags/dd/ins ... csxp2k.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BAAF050B-00F5-4CA8-B89A-8D2BC30F951F}: NameServer = 203.94.227.70,203.94.243.70
O17 - HKLM\System\CCS\Services\Tcpip\..\{D5624540-57CD-4D16-B87F-7463683FBE3F}: NameServer = 203.94.227.70,203.94.243.70
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\siteadvisor\mcieplg.dll
O20 - AppInit_DLLs:
O23 - Service: McAfee Application Installer Cleanup (0211191237283274) (0211191237283274mcinstcleanup) - Unknown owner - C:\WINDOWS\TEMP\0211191237283274mcinst.exe (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c985e895f2fcaa) (gupdate1c985e895f2fcaa) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 9803 bytes
User avatar
chettyharish
Banned Member
 
Posts: 99
Joined: February 3rd, 2008, 4:39 am
Advertisement
Register to Remove

Re: Am I Infected?

Unread postby Odd dude » May 21st, 2009, 8:31 am

Welcome back, chettyharish.

Do you use a router?

Open hijackthis, click do a system scan only, put a check next to O20 - AppInit_DLLs:, click fix checked. Allow the prompt from TeaTimer if it pops up.

Log looks OK. The IP address 192.168.1.3 is in the 192.168.x.x range, this range is most commonly used by routers.

The blue screen error may be hardware related. We can do some more scans, but if it turns out to be unrelated to malware, I can refer you to a forum which offers general computer troubleshooting.
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Am I Infected?

Unread postby chettyharish » May 21st, 2009, 9:00 am

Firest Thanks For Welcoming :bigsmurf: I am gonna try to appeal for training again :)
Yes I Got Dlink ADSL router
I solved the blue screen problem it was problem with nvidia graphics driver due to update :)
Its just my net its not too good it sometimes disconnects suddenly and again reconnects and its also not as good as it used to be I believe this specifically happens when Fallout 3 is running but now it happens all the time Hope you can help :)
User avatar
chettyharish
Banned Member
 
Posts: 99
Joined: February 3rd, 2008, 4:39 am

Re: Am I Infected?

Unread postby Odd dude » May 21st, 2009, 9:50 am

The IP address was from the router - the entries Comodo had been blocking are fine.

Good luck with reappealing for training. ;)

For the other issues, I don't think they're malware related. If you disagree with me on that, we can run some more scans, otherwise I can give you some tips to prevent malware infections and send you off to a forum which offers general computer troubleshooting.
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Am I Infected?

Unread postby chettyharish » May 22nd, 2009, 5:02 am

hmmm even i accept it doesnt seem malware something related with the game ima try to see whats the problem ty for help :)
what abut comodo blocking shud i turn it on?
User avatar
chettyharish
Banned Member
 
Posts: 99
Joined: February 3rd, 2008, 4:39 am

Re: Am I Infected?

Unread postby chettyharish » May 22nd, 2009, 5:55 am

Here is the comodo thing should i allow it if yes then plz tell how :) i cant search due to stupid net

COMODO Internet Security Logs

Table

:

Firewall Logs

Date Created

:

5/22/2009 3:21:46 PM

Log Scope

:

Last 30 Days

Records count

:

24
Date/Time Application Action Source IP Source Port Destination IP Destination Port Protocol
5/1/2009 4:28:40 PM Windows Operating System Blocked 92.143.121.93 3074 192.168.1.3 3074 UDP
5/6/2009 2:23:27 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 57400 UDP
5/7/2009 1:20:59 PM Windows Operating System Blocked 65.55.42.130 3074 192.168.1.3 3074 UDP
5/7/2009 1:21:06 PM Windows Operating System Blocked 206.16.224.171 3074 192.168.1.3 3074 UDP
5/12/2009 8:59:53 PM Windows Operating System Blocked 65.55.42.130 3074 192.168.1.3 3074 UDP
5/12/2009 9:00:14 PM Windows Operating System Blocked 206.16.224.172 3074 192.168.1.3 3074 UDP
5/12/2009 9:00:23 PM Windows Operating System Blocked 65.55.42.130 3074 192.168.1.3 3074 UDP
5/12/2009 9:00:45 PM Windows Operating System Blocked 206.16.224.172 3074 192.168.1.3 3074 UDP
5/12/2009 9:00:52 PM Windows Operating System Blocked 206.16.224.172 3074 192.168.1.3 3074 UDP
5/12/2009 9:00:54 PM Windows Operating System Blocked 65.55.42.130 3074 192.168.1.3 3074 UDP
5/12/2009 9:01:15 PM Windows Operating System Blocked 206.16.224.172 3074 192.168.1.3 3074 UDP
5/12/2009 9:01:24 PM Windows Operating System Blocked 65.55.42.130 3074 192.168.1.3 3074 UDP
5/12/2009 9:01:45 PM Windows Operating System Blocked 206.16.224.172 3074 192.168.1.3 3074 UDP
5/13/2009 1:20:33 AM Windows Operating System Blocked 203.94.243.70 53 192.168.1.3 60882 UDP
5/13/2009 3:57:41 AM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 63807 UDP
5/14/2009 4:45:37 AM Windows Operating System Blocked 203.94.243.70 53 192.168.1.3 52274 UDP
5/14/2009 12:05:37 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 51693 UDP
5/14/2009 12:06:13 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 57852 UDP
5/16/2009 2:10:05 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 59237 UDP
5/21/2009 3:25:02 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 53117 UDP
5/21/2009 6:53:52 PM Windows Operating System Blocked 203.94.243.70 53 192.168.1.3 59857 UDP
5/22/2009 2:27:23 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 57426 UDP
5/22/2009 2:52:45 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 62085 UDP
5/22/2009 3:06:00 PM Windows Operating System Blocked 203.94.227.70 53 192.168.1.3 58370 UDP
End of The Report
User avatar
chettyharish
Banned Member
 
Posts: 99
Joined: February 3rd, 2008, 4:39 am

Re: Am I Infected?

Unread postby Odd dude » May 22nd, 2009, 6:09 am

The ones which come from your own ISP are fine to allow. I cannot vouch for the others.

I suggest that you consult the Comodo manual to find out how to allow the entries. I don't use the program myself, so I cannot help you with that.
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Am I Infected?

Unread postby chettyharish » May 23rd, 2009, 9:09 am

ah i found the problem it was dumb old microsoft creating problems :P there was contradiction between comodo firewall and office suite update 2 i guess the problem is solved thanks for checking for malware :)
User avatar
chettyharish
Banned Member
 
Posts: 99
Joined: February 3rd, 2008, 4:39 am

Re: Am I Infected?

Unread postby Odd dude » May 23rd, 2009, 9:50 am

You're welcome. :)

Would you like tips to prevent malware infections in the future?
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Am I Infected?

Unread postby chettyharish » May 24th, 2009, 12:11 am

i wasnt malwared :P so nty i already read all threads during training lol so TY for help :"P
User avatar
chettyharish
Banned Member
 
Posts: 99
Joined: February 3rd, 2008, 4:39 am

Re: Am I Infected?

Unread postby Odd dude » May 24th, 2009, 1:46 am

True :pirate:

I will arrange for the topic to be closed. :D
User avatar
Odd dude
Retired Graduate
 
Posts: 2819
Joined: May 18th, 2008, 11:16 am
Location: The Netherlands (GMT +1)

Re: Am I Infected?

Unread postby NonSuch » May 24th, 2009, 2:03 am

As this issue appears to be resolved, this topic is now closed.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 27301
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove


  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 45 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware