HELP: Virus is keeping my computer alive?


Recommended Posts

Check you hosts file. C;\Windows\System32\Drivers\etc\hosts

You should only see local host in there. Let us know if you see anything else. What OS are you using windows 7?

I got this:

# Copyright © 1993-2009 Microsoft Corp.

#

# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.

#

# This file contains the mappings of IP addresses to host names. Each

# entry should be kept on an individual line. The IP address should

# be placed in the first column followed by the corresponding host name.

# The IP address and the host name should be separated by at least one

# space.

#

# Additionally, comments (such as these) may be inserted on individual

# lines or following the machine name denoted by a '#' symbol.

#

# For example:

#

# 102.54.94.97 rhino.acme.com # source server

# 38.25.63.10 x.acme.com # x client host

# localhost name resolution is handled within DNS itself.

# 127.0.0.1 localhost

# ::1 localhost

I got this:

Thats fine and is not causing your issue. With the result of you sfc that you posted above as well. I would suggest a repair install at this point. Are you using XP or windows 7?

Thats fine and is not causing your issue. With the result of you sfc that you posted above as well. I would suggest a repair install at this point. Are you using XP or windows 7?

in his first post he says it's windows 7

like I said before, run the "sfc /scannow" from the windows 7 install disk, that should allow you to repair the damaged files

and about this being a virus: i don't believe this is so much a virus as it is a bug in the megakey program, i believe it's caused by the way megakey changes ads, so in a way that .dll is a proxy that has edited vital system files so they have to go through that file to access the internet, and for some reason the uninstaller didn't change the code back thus causing your problem

an "sfc /scannow" from the windows install disk should allow you to repair the files and fix your problem

While my tv show buffered here is what i have found for the user and helpers:

Reported Behavior

  • Action:Trojan downloader activity - 52 x
  • Action:Spyware like activity - 42 x
  • Action:Modify autorun entries - 24 x
  • Action:Inject code to other applications - 1 x

Source: http://isthisfilesaf...B1_details.aspx

Other Megakey files

MegaIeHelper.dll, MegaIeHelper64.dll, MegakeyUpdater.exe, msadm.dll

Soure: http://www.pc1news.c...egakey-exe.html

too much info to paste click below (some info is in expandable links):

Clicky: http://www.system-tray-cleaner.com/systray/programs.php?appid=C4EB3C56BD255C588EC9DC5AEFFB582B00279200#div0name

info from someones hijackthis log:

O10 - Unknown file in Winsock LSP: d:\programdata\megamedia\megakey\msadm.dll

Source: http://forums.techgu...blem-major.html

hope this helps, i normally just format and reinstall less hassle lol

Hi, I don't know why but I cannot access the previous thread. Is it some neowin forum problem? I can open all other topics except this one.

Anyway, from where I left off..

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 12:02:51 PM, on 27/11/2011

Platform: Windows 7 (WinNT 6.00.3504)

MSIE: Internet Explorer v9.00 (9.00.8112.16421)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\BisonCam\BsMnt.exe

C:\Program Files\Lenovo\Energy Management\utility.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesApp32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\IPS\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office14\GROOVEEX.DLL

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~3\Office14\URLREDIR.DLL

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\coIEPlg.dll

O4 - HKLM\..\Run: [bsMnt] C:\Windows\BisonCam\BsMnt.exe

O4 - HKLM\..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe

O4 - HKLM\..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe

O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe

O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Firefox] C:\Program Files\Mozilla Firefox 4.0 Beta 6\firefox.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office14\EXCEL.EXE/3000

O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~3\Office14\ONBttnIE.dll/105

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll

O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O10 - Unknown file in Winsock LSP: c:\programdata\megamedia\megakey\msadm.dll

O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Device Error Recovery Service (dgdersvc) - Devguru Co., Ltd. - C:\Windows\system32\dgdersvc.exe

O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\18.6.0.29\ccSvcHst.exe

O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe

--

End of file - 6848 bytes

Yes, on firefox it's no proxy, and in IE "automatically detect settings" is checked. Spybot? I haven't used that in years.....I thought malwarebytes and others were more efficient! Anyway I've already used Kaspersky TDSS, malwarebytes AND norton full system scan....still nothing! Will try your portable apps suggestion now :)

Yeah,

Spybot is old stuff now a days.

Try SuperAntiSpyware - Free version

http://www.superantispyware.com/

Otherwise, and as much as I try to refrain from telling anyone to reinstall Windows, I think you're about there.

With your HijackThis, paste it into http://hijackthis.de and still be careful at what you remove.

Looking at it, you've got like 8 files which can go.

Use CCleaner, I've never liked it but had to use it the other day as nothing else would touch the problem, but I was actually impressed (deleted it straight after though), as I was silly on that occasion hence the infection

Combofix is your friend for crap like this:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

if you have to, use a different computer to download Combofix.exe, disable UAC, disable your Antivirus and run it, let it do it's thing, it might take a while, let it run, let it reboot if needed, it should take care of things.

Yeah,

Spybot is old stuff now a days.

there is nothing wrong with Spybot S&D

the new version currently in beta is actually quite good at what it does

Combofix is your friend for crap like this:

http://www.bleepingc...to-use-combofix

if you have to, use a different computer to download Combofix.exe, disable UAC, disable your Antivirus and run it, let it do it's thing, it might take a while, let it run, let it reboot if needed, it should take care of things.

be warned though that you should be very careful with combofix as it may just completely brick your OS if your not careful

be warned though that you should be very careful with combofix as it may just completely brick your OS if your not careful

I have never had any issue with combofix, I run it at my shop multiple times daily, the only time I ever "bricked" an OS was when a tech ran it on Windows 2000.

Other then that one issue, I've run it flawlessly 100's of times.

I have never had any issue with combofix, I run it at my shop multiple times daily, the only time I ever "bricked" an OS was when a tech ran it on Windows 2000.

Other then that one issue, I've run it flawlessly 100's of times.

yes, but you know how to use it, someone who's never used it before should at least be warned that it can happen

edit: quote taken directly from the combofix link you posted

You should not run ComboFix unless you are specifically asked to by a helper. Also, due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer.

Try running winsock fix. http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml

If that doesn't work then as suggested run combofix. Before you run combofix however, disable your AV. Also if you have any databases on your PC, like SQL databases for example, it will cause issues and it is not suggested to run combofix otherwise, combofix will most likely not cause any issues. However I would advise that you backup personal data before running it, just in case.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When combofix is finished. It will pop up a log file. If it does not fix your issues, attach the log file here. However if it does fix your issues, from a run box, run combofix /uninstall. This will completely remove combofix from your PC.

msacm.dll is simply Microsoft Audio Compression Manager; it's harmless and is required for Windows to work. If you can move it, try putting it into \Windows\System32... then you can delete the MegaMedia folder out of your Program Files.

Something else is causing the iPad issue.

msacm.dll is simply Microsoft Audio Compression Manager; it's harmless and is required for Windows to work. If you can move it, try putting it into \Windows\System32... then you can delete the MegaMedia folder out of your Program Files.

Something else is causing the iPad issue.

you have obviously misread as the file in question is msadm.dll not msacm

Ah, then ignore me. Looks like when I googled "msadm.dll", Google decided to point blank ignore what I was asking for, and instead show me msacm.dll results... sorry!

yeah, happened to me too when i was looking it up, no worries mate

  • 4 months later...

i think have the exact same problem as you do i have Norton and my ipod will not sync no matter what i do. I tried everything from uninistaliing itunes to deleting itunes library. I thought it was a itunes problem until i remembered megakey and how i uses it a couple months back. I went to the location and there it was. I extracted megakey uninstall and put in in that folder but now my chrome won't work any help will help me as I have the same problem. Not i have done full system scans will malwarebytes and norton but nothing will work.

sptd is not something to worry of as it used by dameon tools and probley other programs though not sure which if i remember rightly sptd also have there own uninstaller website wise

This thread has a bunch of helpful replies, a couple that I've quoted for you do are the following:

Try opening up command or pshell and run the following:

netsh winsock reset catalog

netsh int ip reset reset.log

Best to try the above in elevated command prompt (right click and run as admin)

Post a log from HijackThis

http://www.trendmicr.../HiJackThis.msi

Is this still a problem?

I usually clean infections in the order below:

  1. Run CCleaner to clean system/temp files and browser caches etc., then use it to fix up Registry issues and cleanup any unwanted startup entries.
  2. Update Malwarebytes, boot into Windows Safe Mode and run a Full Scan - which will delete any malicious files if found; a reboot may be required.
  3. Download the latest ComboFix executable and run it under Windows Safe Mode - this runs a rootkit scan as well.
  4. if the infection is still there, run a Full scan with Dr. Web CureIt!
  5. Some infections mess with the networking interfaces so you may have to do a Winsock and TCP/IP Stack reset as pointed out above. Also check your TCP/IP Properties for your LAN and/or WLAN connections to make sure the DNS and IP addressing is set normally i.e. IP addresses come from the DHCP server (your router); if you don't have a Static IP address set that is, and DNS server/s are configured to router's gateway address.

If all else fails, best not to waste too much more time on this as it seems as though it may be a pretty serious virus/malware infection - just backup your data (make sure your data is not infected) and reformat your hard drive :(

Hope this helps somewhat!

This topic is now closed to further replies.
  • Posts

    • The quantum search for Time's origin had an equally mind-boggling conclusion by Sayan Sen Image by Steve Johnson via Pexels A theoretical study from researchers at the University of Surrey suggested that the direction of time may not be fundamentally fixed in certain quantum systems. The work, published in Scientific Reports, examined how the “arrow of time” could emerge from microscopic physics and found that time-reversal symmetry can remain intact even in models used to describe processes such as energy loss and thermalisation. The arrow of time refers to the observed one-way direction from past to future in everyday life. In macroscopic processes, this is easy to see. Spilled milk spreads across a table and does not gather back into a glass, and heat flows from hotter objects to colder ones. These processes shape the common sense idea that time moves in a single direction. However, at the level of fundamental physics, many equations do not prefer a direction of time. Time-reversal symmetry means that the same physical laws can describe a system whether time moves forward or backward. This has made it difficult to explain why irreversible behaviour appears in the large-scale world even when the underlying rules do not require it. Dr Andrea Rocco, Associate Professor in Physics and Mathematical Biology at the University of Surrey, described this contrast: "One way to explain this is when you look at a process like spilt milk spreading across a table, it's clear that time is moving forward. But if you were to play that in reverse, like a movie, you'd immediately know something was wrong – it would be hard to believe milk could just gather back into a glass. However, there are processes, such as the motion of a pendulum, that look just as believable in reverse. The puzzle is that, at the most fundamental level, the laws of physics resemble the pendulum; they do not account for irreversible processes. Our findings suggest that while our common experience tells us that time only moves one way, we are just unaware that the opposite direction would have been equally possible." The study focused on open quantum systems, which are quantum systems that interact with a surrounding environment. This environment, often described as a heat bath, can exchange energy and information with the system. The researchers used this framework to study how a direction of time might appear even when the underlying physics does not enforce one. A key part of the analysis involved the Markov approximation. This is a simplification used in many models where the system is assumed not to retain memory of its past states. The idea is that changes depend only on the current state, not on earlier history. This is commonly used when studying thermalisation, which is the process where a system settles into equilibrium with its environment. The study also used concepts such as master equations, including the Lindblad and Pauli equations, which describe how probabilities of different quantum states change over time. Another related model discussed was quantum Brownian motion, which describes the random-like movement of a quantum particle interacting continuously with its environment. In these descriptions, a “memory kernel” can appear, which is a mathematical term that accounts for how past states influence current behaviour. The researchers found that applying the Markov approximation did not break time-reversal symmetry. Even when the system interacted with an effectively infinite heat bath, the resulting equations of motion remained symmetric in time. This meant that the same mathematical description could, in principle, run forward or backward in time without contradiction. The study further showed that standard frameworks used in open quantum systems, including quantum Brownian motion and master equations like the Lindblad and Pauli forms, could be written in a time-symmetric way. These equations are typically used to describe processes that look irreversible, such as dissipation and thermalisation, but the results suggested they can also be interpreted as allowing evolution in both time directions. Thomas Guff, Research Fellow in Quantum Thermodynamics, said: "The surprising part of this project was that even after making the standard simplifying assumption to our equations describing open quantum systems, the equations still behaved the same way whether the system was moving forwards or backwards in time. When we carefully worked through the maths, we found that this behaviour had to be the case because a key part of the equation, the "memory kernel," is symmetrical in time. We also found a small but important detail which is usually overlooked – a time discontinuous factor emerged that kept the time-symmetry property intact. It’s unusual to see such a mathematical mechanism in a physics equation because it's not continuous, and it was very surprising to see it appear so naturally." The researchers also noted that deriving a one-way arrow of time from time-reversal symmetric microscopic dynamics remains an open problem across fields such as thermodynamics, statistical mechanics, particle physics, and cosmology. Their results suggested that some standard descriptions of irreversible behaviour in open quantum systems may be better understood using a time-symmetric formulation of Markovianity. According to the study, processes such as thermalisation, which are usually treated as irreversible, could in theory be described in a way that allows evolution in either time direction under the same rules. This does not imply that time reversal occurs in everyday life, but rather that the underlying equations do not strictly enforce a single direction. Overall, the findings suggested that the perceived direction of time may emerge from how physical systems are modelled and approximated, rather than from a fundamental asymmetry in the laws themselves. The researchers noted that this perspective could have implications for ongoing work in quantum mechanics, thermodynamics, and cosmology on the origin of time’s arrow. Source: University of Surrey, Nature This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing
    • A bit premature... 100% Marketing. Bizarre.
    • A $300 price hike is insane! No one is going to want to pay that much!
    • Since the 1st one flopped, there is really no reason to make another one. It's just losing money left and right.
  • Recent Achievements

    • Reacting Well
      BizSAR earned a badge
      Reacting Well
    • First Post
      AndreaB earned a badge
      First Post
    • Week One Done
      Huge Trailer earned a badge
      Week One Done
    • Week One Done
      Classifyskilleducation earned a badge
      Week One Done
    • One Month Later
      eurospharma62 earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      581
    2. 2
      +Edouard
      182
    3. 3
      PsYcHoKiLLa
      75
    4. 4
      Michael Scrip
      73
    5. 5
      neufuse
      64
  • Tell a friend

    Love Neowin? Tell a friend!