Heartland

Hello everyone,

Over the last few days the Vista PC has been running slow. The hard-drive is always busy, orange light flashes continuously. I did an AVG Anti-Virus full scan and originally found "Trojan horse generic10.MGI". Went to a website called "CastleCops" for help and followed their Malware removal instructions but the problems remain!

Now, following the Malware detection/removal procedure , on startup I get a message saying: RunDLL Error loading C:\Users\COWLIN\AppData\Local\Temp\awtrRjHW.dll The specified module could not be found.

Also, when online I get popups for anti spyware programs and new tabs are opening automatically.
Also, the Start button doesn't respond, when it's clicked I hear a "ping" noise from the speakers.

During the numerous scans performed (in line with CastleCops instructions) Ad-Aware found only 1 cookie, Windows Defender found nothing, Spybot S&D found nothing, AVG Anti-Spyware found 23 tracking cookies and a final AVG Anti-Virus full scan found "JS/Psyme"; all of which have been deleted.

In "currently running processes" (Task Manager) I can see a few potentially suspect programs/processes, including "wininit.exe" and two instances of "csrss.exe".

The PC has been scanned with:
CCleaner,
Ad-Aware,
Spybot S&D,
Windows Defender,
AVG Anti-Spyware
AVG Anti-Virus
Spyware Doctor.

The scans all ran successfully but found little (see above).

Here is a HijackThis log which was made a couple of minutes ago, could one of you techies please have a look at it and see if you can resolve my problem!


---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:43:41, on 20/04/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Creative\MediaSource5\MtdAcqu.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Windows\system32\CTsvcCDA.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\PnkBstrA.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MtdAcqu] "C:\Program Files\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\COWLIN\AppData\Local\Temp\fccyyvsp.dll,c
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\COWLIN\AppData\Local\Temp\awtrRjHW.dll,#1
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\StartRegistryBooster.exe
O4 - HKCU\..\Run: [BM139ebcfc] Rundll32.exe "C:\Users\COWLIN\AppData\Local\Temp\ucffvlnt.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 10104 bytes

I just asked a friend of mine who works as programer, he suggests you to get an online virus check on the site of Panda Antivir. In case your own antivir is f*cked, this, he thinks, is the best alternative.
It needs a couple of activeX conrols available for the scan.
I was thinking you might have caught a rootkit, but normally, Spybot S&D checks for them since a recent update.
That's all I can tell you, good luck mate!

Sounds like the one I had a while back.
Does HL display odd avatars & banners (windows advertising antivirus software etc.)?

I had to have the whole OS re-installed.

I'm currently running "eset"'s online virus scan but will also try Panda Antivir after

Pista: HL doesn't display odd banners but other websites (advertising antivirus software) do .

You have simply got to stop visiting those Russian porn sites

What browser are you using? There is absolutely NO EXCUSE for using IE, even under Vista. If you're not using Firefox, get it. When I was a PC user, I used to run Adaware and virus scans weekly, until I switched to Firefox. Then I started doing it about once a year, because nothing got through.

Are you using warez habitually? You shouldn't be.

Also, take a look here: http://shsc.info/UsefulWindowsSoftware#titelanker22

EDIT:

Bad news: wininit.exe apparently shows up as a result of the WOLLF.16 virus, whatever that is. It's a Trojan of some sort. csrss.exe is probably a legitimate part of Vista, but don't take my word for it. Oh, and it looks like there's also a Wininit.exe, with a capital W, which is a legit part of Windows.

And just to beat James to it: Get a Mac.

Another edit: does Vista allow a boot into a safe mode with minimal drivers, etc? You might need to run these AV, etc, programs there instead of in a fully booted OS.

Yeh we ran the virus scans in safe mode

Might look into that Firefox business, is it much different to IE?

Oh, regarding csrss.exe, it looks like it's only legit if it lives in C:\Windows\System32. It looks like the virus Nimda.E shows up with the same name. Hanging out in the seedier corners of the internet lately?

robertzombie wrote:Yeh we ran the virus scans in safe mode

Might look into that Firefox business, is it much different to IE?

It's vastly superior, and after a few days you'll wonder how you lived without it. Best of all, unlike IE, it doesn't leave all sorts of pathways into your system open.

robertzombie wrote:Yeh we ran the virus scans in safe mode

Might look into that Firefox business, is it much different to IE?

Safe mode is one option & if you can disable system restore point while you clean the bugger off, that also helps.
Otherwise your wonderful PC will just restore the b@stard.
Can't remeber the name of the one I had, but it was a pig.

The odd windows isn't a good sign ( I was getting them when I came here. The banner was one huge antivirus advert). If it's the same as mine, then cut your losses & re-install everything. Yeah, it's a pain in the bum, but it's quicker than spending hours trying to kill it.

Damn porn and warez stuff^^

During the PC is slow - is there a specific process visible inside the task manager wich causes a high CPU usage?

Is there enough free memory for the swapdrive?

What about the windows internal error logs?

svchost.exe is using up tonnes of memory.

Have a look here for some tips on killing off this rubbish: http://www.codinghorror.com/blog/archives/000888.html

robertzombie wrote:svchost.exe is using up tonnes of memory.

Good news: it's a Windows process, something to do with DLL's.

Bad news: apparently electronic hobgoblins have been known to disguise themselves as svchost.exe.

It may be easier for you to just flatten and reinstall... but then there's the question of backing up files and how to make sure that they're not infected eitherl. If you do flatten and reinstall, make sure that the first thing you do when you get online with IE is download Firefox and start using that instead. If you don't... download it now and start using it instead. Seriously.

mh wrote:Have a look here for some tips on killing off this rubbish: http://www.codinghorror.com/blog/archives/000888.html

God almighty, am I glad I don't have to worry about doing all that shit anymore.

robertzombie wrote:...the Vista PC has been running slow

Normal behaviour, n'est-ce pas?

Sorry couldn't resist.

DerekR wrote:

robertzombie wrote:...the Vista PC has been running slow

Normal behaviour, n'est-ce pas?

Sorry couldn't resist.

Beat me to it

Here you can find all info about all these little files, DLL and otherwise

Just type in the name of the file you are not sure about. Mind capitals, as they might be the difference between a legit file and a Trojan! (see example a couple of posts ago)

Might take you a while, but it will leave you a bit wiser (no, not Budweiser) in the end!


IZ.

Can't you rolll it back to a safe restore point?

mh wrote:Have a look here for some tips on killing off this rubbish: http://www.codinghorror.com/blog/archives/000888.html

Cheers Mike, did this and it looks like I've cleared most/all of the infection!
I posted a HijackThis log on a techy website and hopefully they'll tell me if there's anything else I need to remove.

This post was bought to you by

robertzombie wrote:

mh wrote:Have a look here for some tips on killing off this rubbish: http://www.codinghorror.com/blog/archives/000888.html

Cheers Mike, did this and it looks like I've cleared most/all of the infection!
I posted a HijackThis log on a techy website and hopefully they'll tell me if there's anything else I need to remove.

This post was bought to you by

Good stuff.

Next step is to not run as an Administrator. It might cause you some hassle, but it'll save you a whole world of pain.

Also, if you're using Norton or McAfee for anti-virus, ditch them and get AVG.

The bastards came back! Looks like I got rid of part of but not all the infection and maybe it regenerated itself?

I've finally removed the whole problem (fingers crossed) by using a simple, small program called "Comodo BOClean".

It runs in the background in the corner of the screen from start up and monitors programs that try to run, it checks these against it's Trojan database and stops suspect .exe's/suspect things from running, it then asks you if you want to remove them from your system. Before I installed this the PC was being REALLY slow and the hard drive was cacking and spluttering like an old diseased man. Got this installed, rebooted, and the little BOCleaner icon flashed a bit at start up and now everything appears to be running fine!

Antivirus software frequently fails to detect, and more often fails to effectively clean most malware. BOClean runs automatically in the background without interfering with your work and kills malwares INSTANTLY the moment they activate without giving them the chance to invade your machine. BOClean also eliminates the need to stop what you're doing to secure your machine after it's too late. BOClean works with all versions of Windows 2000 and XP (with or without service packs). Unlike antivirus programs, BOClean will actually shut them down and destroy them without the need for you to seek out the method of removal or risking dangerous editing of your system's innermost configurations. BOClean requires no technical skills and handles detection, removal and repair of your system automatically.

http://www.comodo.com/boclean/boclean.html

It'll only be a matter of time before it takes control again.
Mine was some variant of trojan vundo
It's stubborn SOB & even the removal tools specificaly designed for it had a job to get it off.
But it just came back over & over again.
I spent more time cleaning the fecker off than actually using the machine normally.
Sorry, but that's what happened to me & I still say clean the whole lot off & re-install the whole lot from the ground up.
These programs are just like band aids. Eventually you'll need a new one.

I can't understand why anyone would choose to run Vista.

Install a Linux distro if you can't get a mac.

markfiend wrote:I can't understand why anyone would choose to run Vista.

Install a Linux distro if you can't get a mac.

I still run XP and happy about it.

Both Vista and Linux alike are a bugger to use with audio.

Linux will get there in the end, but is still hopping far behind re audio drivers, software and intercompatibility (wow!) between instruments/Effects (VSTi, RTAS etc...)

Otherwise I would have installed Linux ages ago...

IZ.

robertzombie wrote:The bastards came back! Looks like I got rid of part of but not all the infection and maybe it regenerated itself?

I've finally removed the whole problem (fingers crossed) by using a simple, small program called "Comodo BOClean".

It runs in the background in the corner of the screen from start up and monitors programs that try to run, it checks these against it's Trojan database and stops suspect .exe's/suspect things from running, it then asks you if you want to remove them from your system. Before I installed this the PC was being REALLY slow and the hard drive was cacking and spluttering like an old diseased man. Got this installed, rebooted, and the little BOCleaner icon flashed a bit at start up and now everything appears to be running fine!

Antivirus software frequently fails to detect, and more often fails to effectively clean most malware. BOClean runs automatically in the background without interfering with your work and kills malwares INSTANTLY the moment they activate without giving them the chance to invade your machine. BOClean also eliminates the need to stop what you're doing to secure your machine after it's too late. BOClean works with all versions of Windows 2000 and XP (with or without service packs). Unlike antivirus programs, BOClean will actually shut them down and destroy them without the need for you to seek out the method of removal or risking dangerous editing of your system's innermost configurations. BOClean requires no technical skills and handles detection, removal and repair of your system automatically.

http://www.comodo.com/boclean/boclean.html

and how it removes all the trojans?