HELP: Virus is keeping my computer alive?

[Simon.]

Post a log from HijackThis

http://www.trendmicr.../HiJackThis.msi

Also, sfc logs to %windir%\logs\cbs\cbs.log, can you post that file too?

[ceminess]

Check you hosts file. C;\Windows\System32\Drivers\etc\hosts

You should only see local host in there. Let us know if you see anything else. What OS are you using windows 7?

[zheng.93]

Check you hosts file. C;\Windows\System32\Drivers\etc\hosts

You should only see local host in there. Let us know if you see anything else. What OS are you using windows 7?

I got this:

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.

# 127.0.0.1 localhost

# ::1 localhost

[ceminess]

I got this:

Thats fine and is not causing your issue. With the result of you sfc that you posted above as well. I would suggest a repair install at this point. Are you using XP or windows 7?

[Brandon H Supervisor]

Thats fine and is not causing your issue. With the result of you sfc that you posted above as well. I would suggest a repair install at this point. Are you using XP or windows 7?

in his first post he says it's windows 7

like I said before, run the "sfc /scannow" from the windows 7 install disk, that should allow you to repair the damaged files

and about this being a virus: i don't believe this is so much a virus as it is a bug in the megakey program, i believe it's caused by the way megakey changes ads, so in a way that .dll is a proxy that has edited vital system files so they have to go through that file to access the internet, and for some reason the uninstaller didn't change the code back thus causing your problem

an "sfc /scannow" from the windows install disk should allow you to repair the files and fix your problem

[remixedcat]

take a look at your HOSTS file. clean out anything bad.

[Xoligy]

While my tv show buffered here is what i have found for the user and helpers:

Reported Behavior

• Action:Trojan downloader activity - 52 x
  
• Action:Spyware like activity - 42 x
  
• Action:Modify autorun entries - 24 x
  
• Action:Inject code to other applications - 1 x
  

Source: http://isthisfilesaf...B1_details.aspx

Other Megakey files

MegaIeHelper.dll, MegaIeHelper64.dll, MegakeyUpdater.exe, msadm.dll

Soure: http://www.pc1news.c...egakey-exe.html

too much info to paste click below (some info is in expandable links):

Clicky: http://www.system-tray-cleaner.com/systray/programs.php?appid=C4EB3C56BD255C588EC9DC5AEFFB582B00279200#div0name

info from someones hijackthis log:

O10 - Unknown file in Winsock LSP: d:\programdata\megamedia\megakey\msadm.dll

Source: http://forums.techgu...blem-major.html

hope this helps, i normally just format and reinstall less hassle lol

[zheng.93]

Hi, I don't know why but I cannot access the previous thread. Is it some neowin forum problem? I can open all other topics except this one.

Anyway, from where I left off..

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:02:51 PM, on 27/11/2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\BisonCam\BsMnt.exe

C:\Program Files\Lenovo\Energy Management\utility.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

O4 - HKLM\..\Run: [bsMnt] C:\Windows\BisonCam\BsMnt.exe

O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe

O4 - HKLM\..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe

O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Firefox] C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe

O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--

End of file - 6848 bytes

[Yusuf M. Veteran]

Merged

[Ryanjmchale]

Try opening up command or pshell and run the following:

netsh winsock reset catalog

netsh int ip reset reset.log

[mduren2445]

you can tryy safe mode and renameing the files in question (msadm.dll to msadm.old) and see if that solves your problem but I would just save your data and nuke it and restore.

[cork1958]

Yes, on firefox it's no proxy, and in IE "automatically detect settings" is checked. Spybot? I haven't used that in years.....I thought malwarebytes and others were more efficient! Anyway I've already used Kaspersky TDSS, malwarebytes AND norton full system scan....still nothing! Will try your portable apps suggestion now :)

Yeah,

Spybot is old stuff now a days.

Try SuperAntiSpyware - Free version

http://www.superantispyware.com/

Otherwise, and as much as I try to refrain from telling anyone to reinstall Windows, I think you're about there.

[Dan~]

With your HijackThis, paste it into http://hijackthis.de and still be careful at what you remove.

Looking at it, you've got like 8 files which can go.

Use CCleaner, I've never liked it but had to use it the other day as nothing else would touch the problem, but I was actually impressed (deleted it straight after though), as I was silly on that occasion hence the infection

[devilotX]

Combofix is your friend for crap like this:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

if you have to, use a different computer to download Combofix.exe, disable UAC, disable your Antivirus and run it, let it do it's thing, it might take a while, let it run, let it reboot if needed, it should take care of things.

[Brandon H Supervisor]

Yeah,

Spybot is old stuff now a days.

there is nothing wrong with Spybot S&D

the new version currently in beta is actually quite good at what it does

Combofix is your friend for crap like this:

http://www.bleepingc...to-use-combofix

if you have to, use a different computer to download Combofix.exe, disable UAC, disable your Antivirus and run it, let it do it's thing, it might take a while, let it run, let it reboot if needed, it should take care of things.

be warned though that you should be very careful with combofix as it may just completely brick your OS if your not careful

[devilotX]

be warned though that you should be very careful with combofix as it may just completely brick your OS if your not careful

I have never had any issue with combofix, I run it at my shop multiple times daily, the only time I ever "bricked" an OS was when a tech ran it on Windows 2000.

Other then that one issue, I've run it flawlessly 100's of times.

[Brandon H Supervisor]

I have never had any issue with combofix, I run it at my shop multiple times daily, the only time I ever "bricked" an OS was when a tech ran it on Windows 2000.

Other then that one issue, I've run it flawlessly 100's of times.

yes, but you know how to use it, someone who's never used it before should at least be warned that it can happen

edit: quote taken directly from the combofix link you posted

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

[ceminess]

Try running winsock fix. http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml

If that doesn't work then as suggested run combofix. Before you run combofix however, disable your AV. Also if you have any databases on your PC, like SQL databases for example, it will cause issues and it is not suggested to run combofix otherwise, combofix will most likely not cause any issues. However I would advise that you backup personal data before running it, just in case.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When combofix is finished. It will pop up a log file. If it does not fix your issues, attach the log file here. However if it does fix your issues, from a run box, run combofix /uninstall. This will completely remove combofix from your PC.

[-Alex-]

msacm.dll is simply Microsoft Audio Compression Manager; it's harmless and is required for Windows to work. If you can move it, try putting it into \Windows\System32... then you can delete the MegaMedia folder out of your Program Files.

Something else is causing the iPad issue.

[Brandon H Supervisor]

msacm.dll is simply Microsoft Audio Compression Manager; it's harmless and is required for Windows to work. If you can move it, try putting it into \Windows\System32... then you can delete the MegaMedia folder out of your Program Files.

Something else is causing the iPad issue.

you have obviously misread as the file in question is msadm.dll not msacm

[-Alex-]

Ah, then ignore me. Looks like when I googled "msadm.dll", Google decided to point blank ignore what I was asking for, and instead show me msacm.dll results... sorry!

[Brandon H Supervisor]

Ah, then ignore me. Looks like when I googled "msadm.dll", Google decided to point blank ignore what I was asking for, and instead show me msacm.dll results... sorry!

yeah, happened to me too when i was looking it up, no worries mate

[ItunesProblems]

i think have the exact same problem as you do i have Norton and my ipod will not sync no matter what i do. I tried everything from uninistaliing itunes to deleting itunes library. I thought it was a itunes problem until i remembered megakey and how i uses it a couple months back. I went to the location and there it was. I extracted megakey uninstall and put in in that folder but now my chrome won't work any help will help me as I have the same problem. Not i have done full system scans will malwarebytes and norton but nothing will work.

[JJ_]

sptd is not something to worry of as it used by dameon tools and probley other programs though not sure which if i remember rightly sptd also have there own uninstaller website wise

This thread has a bunch of helpful replies, a couple that I've quoted for you do are the following:

Try opening up command or pshell and run the following:

netsh winsock reset catalog

netsh int ip reset reset.log

Best to try the above in elevated command prompt (right click and run as admin)

Post a log from HijackThis

http://www.trendmicr.../HiJackThis.msi

[g0dzilla]

Is this still a problem?

I usually clean infections in the order below:

1. Run CCleaner to clean system/temp files and browser caches etc., then use it to fix up Registry issues and cleanup any unwanted startup entries.
   
2. Update Malwarebytes, boot into Windows Safe Mode and run a Full Scan - which will delete any malicious files if found; a reboot may be required.
   
3. Download the latest ComboFix executable and run it under Windows Safe Mode - this runs a rootkit scan as well.
   
4. if the infection is still there, run a Full scan with Dr. Web CureIt!
   
5. Some infections mess with the networking interfaces so you may have to do a Winsock and TCP/IP Stack reset as pointed out above. Also check your TCP/IP Properties for your LAN and/or WLAN connections to make sure the DNS and IP addressing is set normally i.e. IP addresses come from the DHCP server (your router); if you don't have a Static IP address set that is, and DNS server/s are configured to router's gateway address.
   

If all else fails, best not to waste too much more time on this as it seems as though it may be a pretty serious virus/malware infection - just backup your data (make sure your data is not infected) and reformat your hard drive :(

Hope this helps somewhat!