HELP: Virus is keeping my computer alive?


Recommended Posts

Check you hosts file. C;\Windows\System32\Drivers\etc\hosts

You should only see local host in there. Let us know if you see anything else. What OS are you using windows 7?

I got this:

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.

# 127.0.0.1 localhost

# ::1 localhost

I got this:

Thats fine and is not causing your issue. With the result of you sfc that you posted above as well. I would suggest a repair install at this point. Are you using XP or windows 7?

Thats fine and is not causing your issue. With the result of you sfc that you posted above as well. I would suggest a repair install at this point. Are you using XP or windows 7?

in his first post he says it's windows 7

like I said before, run the "sfc /scannow" from the windows 7 install disk, that should allow you to repair the damaged files

and about this being a virus: i don't believe this is so much a virus as it is a bug in the megakey program, i believe it's caused by the way megakey changes ads, so in a way that .dll is a proxy that has edited vital system files so they have to go through that file to access the internet, and for some reason the uninstaller didn't change the code back thus causing your problem

an "sfc /scannow" from the windows install disk should allow you to repair the files and fix your problem

While my tv show buffered here is what i have found for the user and helpers:

Reported Behavior

  • Action:Trojan downloader activity - 52 x
  • Action:Spyware like activity - 42 x
  • Action:Modify autorun entries - 24 x
  • Action:Inject code to other applications - 1 x

Source: http://isthisfilesaf...B1_details.aspx

Other Megakey files

MegaIeHelper.dll, MegaIeHelper64.dll, MegakeyUpdater.exe, msadm.dll

Soure: http://www.pc1news.c...egakey-exe.html

too much info to paste click below (some info is in expandable links):

Clicky: http://www.system-tray-cleaner.com/systray/programs.php?appid=C4EB3C56BD255C588EC9DC5AEFFB582B00279200#div0name

info from someones hijackthis log:

O10 - Unknown file in Winsock LSP: d:\programdata\megamedia\megakey\msadm.dll

Source: http://forums.techgu...blem-major.html

hope this helps, i normally just format and reinstall less hassle lol

Hi, I don't know why but I cannot access the previous thread. Is it some neowin forum problem? I can open all other topics except this one.

Anyway, from where I left off..

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:02:51 PM, on 27/11/2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\BisonCam\BsMnt.exe

C:\Program Files\Lenovo\Energy Management\utility.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

O4 - HKLM\..\Run: [bsMnt] C:\Windows\BisonCam\BsMnt.exe

O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe

O4 - HKLM\..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe

O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Firefox] C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe

O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--

End of file - 6848 bytes

Yes, on firefox it's no proxy, and in IE "automatically detect settings" is checked. Spybot? I haven't used that in years.....I thought malwarebytes and others were more efficient! Anyway I've already used Kaspersky TDSS, malwarebytes AND norton full system scan....still nothing! Will try your portable apps suggestion now :)

Yeah,

Spybot is old stuff now a days.

Try SuperAntiSpyware - Free version

http://www.superantispyware.com/

Otherwise, and as much as I try to refrain from telling anyone to reinstall Windows, I think you're about there.

With your HijackThis, paste it into http://hijackthis.de and still be careful at what you remove.

Looking at it, you've got like 8 files which can go.

Use CCleaner, I've never liked it but had to use it the other day as nothing else would touch the problem, but I was actually impressed (deleted it straight after though), as I was silly on that occasion hence the infection

Combofix is your friend for crap like this:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

if you have to, use a different computer to download Combofix.exe, disable UAC, disable your Antivirus and run it, let it do it's thing, it might take a while, let it run, let it reboot if needed, it should take care of things.

Yeah,

Spybot is old stuff now a days.

there is nothing wrong with Spybot S&D

the new version currently in beta is actually quite good at what it does

Combofix is your friend for crap like this:

http://www.bleepingc...to-use-combofix

if you have to, use a different computer to download Combofix.exe, disable UAC, disable your Antivirus and run it, let it do it's thing, it might take a while, let it run, let it reboot if needed, it should take care of things.

be warned though that you should be very careful with combofix as it may just completely brick your OS if your not careful

be warned though that you should be very careful with combofix as it may just completely brick your OS if your not careful

I have never had any issue with combofix, I run it at my shop multiple times daily, the only time I ever "bricked" an OS was when a tech ran it on Windows 2000.

Other then that one issue, I've run it flawlessly 100's of times.

I have never had any issue with combofix, I run it at my shop multiple times daily, the only time I ever "bricked" an OS was when a tech ran it on Windows 2000.

Other then that one issue, I've run it flawlessly 100's of times.

yes, but you know how to use it, someone who's never used it before should at least be warned that it can happen

edit: quote taken directly from the combofix link you posted

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

Try running winsock fix. http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml

If that doesn't work then as suggested run combofix. Before you run combofix however, disable your AV. Also if you have any databases on your PC, like SQL databases for example, it will cause issues and it is not suggested to run combofix otherwise, combofix will most likely not cause any issues. However I would advise that you backup personal data before running it, just in case.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When combofix is finished. It will pop up a log file. If it does not fix your issues, attach the log file here. However if it does fix your issues, from a run box, run combofix /uninstall. This will completely remove combofix from your PC.

msacm.dll is simply Microsoft Audio Compression Manager; it's harmless and is required for Windows to work. If you can move it, try putting it into \Windows\System32... then you can delete the MegaMedia folder out of your Program Files.

Something else is causing the iPad issue.

msacm.dll is simply Microsoft Audio Compression Manager; it's harmless and is required for Windows to work. If you can move it, try putting it into \Windows\System32... then you can delete the MegaMedia folder out of your Program Files.

Something else is causing the iPad issue.

you have obviously misread as the file in question is msadm.dll not msacm

Ah, then ignore me. Looks like when I googled "msadm.dll", Google decided to point blank ignore what I was asking for, and instead show me msacm.dll results... sorry!

yeah, happened to me too when i was looking it up, no worries mate

  • 4 months later...

i think have the exact same problem as you do i have Norton and my ipod will not sync no matter what i do. I tried everything from uninistaliing itunes to deleting itunes library. I thought it was a itunes problem until i remembered megakey and how i uses it a couple months back. I went to the location and there it was. I extracted megakey uninstall and put in in that folder but now my chrome won't work any help will help me as I have the same problem. Not i have done full system scans will malwarebytes and norton but nothing will work.

sptd is not something to worry of as it used by dameon tools and probley other programs though not sure which if i remember rightly sptd also have there own uninstaller website wise

This thread has a bunch of helpful replies, a couple that I've quoted for you do are the following:

Try opening up command or pshell and run the following:

netsh winsock reset catalog

netsh int ip reset reset.log

Best to try the above in elevated command prompt (right click and run as admin)

Post a log from HijackThis

http://www.trendmicr.../HiJackThis.msi

Is this still a problem?

I usually clean infections in the order below:

  1. Run CCleaner to clean system/temp files and browser caches etc., then use it to fix up Registry issues and cleanup any unwanted startup entries.
  2. Update Malwarebytes, boot into Windows Safe Mode and run a Full Scan - which will delete any malicious files if found; a reboot may be required.
  3. Download the latest ComboFix executable and run it under Windows Safe Mode - this runs a rootkit scan as well.
  4. if the infection is still there, run a Full scan with Dr. Web CureIt!
  5. Some infections mess with the networking interfaces so you may have to do a Winsock and TCP/IP Stack reset as pointed out above. Also check your TCP/IP Properties for your LAN and/or WLAN connections to make sure the DNS and IP addressing is set normally i.e. IP addresses come from the DHCP server (your router); if you don't have a Static IP address set that is, and DNS server/s are configured to router's gateway address.

If all else fails, best not to waste too much more time on this as it seems as though it may be a pretty serious virus/malware infection - just backup your data (make sure your data is not infected) and reformat your hard drive :(

Hope this helps somewhat!

This topic is now closed to further replies.
  • Posts

    • Waymo recalls self-driving software after cars enter closed freeway work zones by Paul Hill Waymo, the self-driving car maker owned by Alphabet – the parent company of Google –, has recalled some of its fifth-generation Automated Driving Systems (ADS). It did so after some of its cars drove through closed construction zones. According to the National Highway Traffic Safety Administration (NHTSA), the affected vehicles were capable of driving through a closed freeway construction zone and continuing to drive at speed. The listing on the NHTSA website says that Waymo is currently developing a solution to fix this issue, but in the meantime, freeway driving is being restricted. Waymo will update its ADS software so that vehicles can detect when they can avoid entering construction zones. According to the Safety Recall Report, on April 20, 2026, Waymo’s Field Safety Committee began meetings reviewing an event from April 11, 2026, and five events from April 19, 2026, where Waymo’s autonomous vehicles didn’t recognize and drove past ramp closure signs into the pre-planned freeway construction zones. This took place in Phoenix, Arizona. Separately, on May 18, 2026, seven Waymo vehicles entered freeway lanes with active construction in the San Francisco Bay Area by driving between cones that were placed to show the lane was closed. On the back of both of these events, Waymo restricted freeway driving until it could address the issue. In June, Waymo’s Safety Board reviewed the issue and additional information related to ADS performances around construction zones; then, as a result, it decided to conduct a recall. This development is not good for Waymo as it adds to a growing list of technical hiccups its cars have experienced. Ultimately, it will lead to more scrutiny from lawmakers around the world who will be more cautious about letting autonomous vehicles on their roads without tighter regulation. For readers in areas where Waymo operates, does this news make you more wary about stepping into one of these vehicles?
    • I'm still on Windows 10 22H2 because I didn't want to deal with all the issues in Windows 11, so I waited almost a week before installing the latest Patch Tuesday update (KB5094127), I went ahead and did it, and it was a huge mistake—ever since then, my File Explorer has seen a performance drop of about 30% when transferring large files... Once again, Microsoft has outdone itself! This update cannot be uninstalled, either through the Control Panel (via Settings) or by accessing Advanced Startup Options. The only possible alternative would be to use system restore points, but I’d have to reinstall all app and driver updates (and there’s no guarantee it would work). Or there’s the “nuclear option” of a in-place repair without losing files or apps, but even then, all my customizations would be lost! Microsoft just can’t help but mess everything up! Way to go, Microsoft! But I still don’t want your c****y Windows 11!
    • Microsoft: Windows 11 could finally solve a major issue across AMD, Nvidia, and Intel GPUs by Sayan Sen While Microsoft has been trying to improve it, Windows 11 is definitely not flawless, as even today some issues are taking a year to publicly acknowledge. However, one area of trouble that may finally see much better results soon is graphics driver crashes. Work on graphics driver timeouts, also called Timeout and Detection Recovery (TDR), is not new as the latest WDDM 3.2 also has specific improvements regarding it. Windows Display Driver Model (WDDM) version 3.2 is supported on Windows 11 24H2 and 25H2. However, with the upcoming version 26H2, TDR crash diagnosis could go to the next level as Microsoft is introducing a new DirectX 12 API feature called "DirectX Dump Files". Similar to how system memory dump files work when a system crashes or freezes or encounters any such major issue, DirectX Dump Files (DDF) will essentially record a snapshot of the GPU execution right at the moment a graphics-related crash or hang or freeze occurs, so that developers can better understand and diagnoze these TDR and timeout detection errors. The dump will be available as a .dxdmp file for analysis and it will be a comprehensive dump file generated with detailed insights about the hardware, drivers, Windows, as well as the affected application. This should be another welcome change in this department. Earlier at GDC 2026, when the technology was first debuted, Microsoft had shared more details regarding it. The company had explained how DDF is designed to gather data from every layer of the graphics stack into a single file, eliminating the need for developers to manually correlate logs from multiple tools. As mentioned above, the dump can contain a lot of useful details like GPU hardware state information such as register values, shader program counters, page fault virtual addresses, shader memory data, and command buffers. Alongside that, it also captures DirectX runtime and kernel information, including D3D objects, pipeline state objects, device error data, adapter details, and CPU call stacks. Microsoft says the feature has been built around two primary use cases: retail device removals and local device removals. The former allows developers to collect crash information from end users' systems in the field, while the latter helps QA teams and developers investigate issues on test machines. Developers will also be able to include up to 2 MB of custom application data through new D3D12 APIs, providing additional context for troubleshooting. In addition, Microsoft is introducing three dump collection modes ranging from zero-overhead capture, which has no runtime performance impact on supported hardware, to higher-detail modes that collect more vendor-specific debugging data. On compatible Tier 2 hardware, zero-overhead dumps will be enabled by default, meaning developers may begin receiving useful crash diagnostics without making any code changes. The table below explains the three tiers: Tier Description NO_OVERHEAD Enables crash capture with no runtime cost and is suitable for broad deployment MEDIUM_OVERHEAD Provides a balance, capturing additional diagnostic data with moderate impact HIGH_OVERHEAD Collects the most detailed GPU and driver state available, enabling deeper investigation at the cost of higher runtime overhead In terms of availability, the company expects broader release to be around the fall of 2026, which should be right around the time when Windows 11 version 26H2 lands. Right now, DirectX Dump Files are available as a preview and currently, only AMD has the compatible AgilitySDK Developer Preview driver version 26.10.07.02. You can find the official announcement post here on Microsoft's website.
    • And with SO much better perf than the laggy mess that is Files.
  • Recent Achievements

    • First Post
      BizSAR earned a badge
      First Post
    • Week One Done
      Jordan Smith earned a badge
      Week One Done
    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      598
    2. 2
      +Edouard
      190
    3. 3
      PsYcHoKiLLa
      80
    4. 4
      Michael Scrip
      76
    5. 5
      Steven P.
      69
  • Tell a friend

    Love Neowin? Tell a friend!