Options

AVG issues, vibration - rollingdan

Unknown
edited July 2004 in Spyware & Virus Removal
Hello,

I just did a scan of my hard drive with AVG and came up with 5 infected files. One file AVG was able to heal and the other 4 went to a vault.

Anything to do as this point?

All the files came from windows directory and are listed below:

alchem.exe
corelsys.dll
\system\corelsys.dll
\system\windialup\3036\dial.exe
\downloaded Program Files\IST activex.dll

In the vault under the 0 column it has an icon that says backup copy for the first line above and removed for the rest of the 4 other lines above when you put your cursor on the icon.

Thanks!

Dan
PS Why is my cursor vibrating when I type?

Comments

  • DexterDexter Vancouver, BC Canada
    edited July 2004
    The "healed" one means it is repaired. The vault is a quarantine directory, that AVG has marked them off as being moved from where they were and therefore not usable by whatever program or registry entry was calling them. They are all safe now.

    Vibrating....that's strange. When did that start?

    Dexter...
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited July 2004
    It can't "heal" them because they are not legitimate files, they are virus executables. All you can do is delete them, which you should do.

    Do you have a touchpad? Are you on a laptop? Can't help you with the cursor vibrating thing. Try unplugging and re-plugging your mouse.
  • rollingdan
    edited July 2004
    Dexter wrote:
    The "healed" one means it is repaired. The vault is a quarantine directory, that AVG has marked them off as being moved from where they were and therefore not usable by whatever program or registry entry was calling them. They are all safe now.

    Vibrating....that's strange. When did that start?

    Dexter...

    Not too long after I joined last week. I thought it was the smilies that were making my curson move around. Only happens in this forum. I'm on a desktop.
    Tried to unplug mouse and plug it back in. No success.

    Thanks for everything.

    Dan
    PS When removing files with HJT, do you recommend being in safe mode?
  • DexterDexter Vancouver, BC Canada
    edited July 2004
    rollingdan wrote:
    Not too long after I joined last week. I thought it was the smilies that were making my curson move around. Only happens in this forum. I'm on a desktop.
    Tried to unplug mouse and plug it back in. No success.

    Thanks for everything.

    Dan
    PS When removing files with HJT, do you recommend being in safe mode?


    Post an HJT log so we can take a peek...

    Yes, I, and most of the folks here, usually recommend being in safe mode when removing known problems. In safe mode, you can usually delete items that often cannot be removed in normal mode, as quite often if a process is running, it will not allow itself to be stopped and removed. Safe mode avoids that, as it does not launch most processes to being with, only those needed by Windows to boot and run.

    Dexter...
  • dodododo Landisville, PA
    edited July 2004
    Do you have a cheaper logitech optical mouse? and what surface is the mouse on?

    ~dodo
  • rollingdan
    edited July 2004
    Ok, I will run Ad-aware, Spybot and then HJT, then I will post my log. I ran AVG scan last night and it came back with no viruses. Finally!

    My mouse is an HP M-534. It sits on a regular mouse pad. Like I said before dodo, my cursor doesn't vibrate at all except for in this forum when I am typing right now. When I am viewing it's fine. Only when I type. It doesn't do this any where else.

    Thanks again!!!! Appreciate it!

    Dan
  • DexterDexter Vancouver, BC Canada
    edited July 2004
    If it only happens here, there may be some conflict with something on your system and the Vbulletin software that runs this board. I've asked our site's design master to have a look at this thread.

    Dexter...
  • ShortyShorty Manchester, UK Icrontian
    edited July 2004
    Never heard of a vibrating cursor at all, there is certainly no code that would cause that here :)

    What browser? What mouse?
  • rollingdan
    edited July 2004
    Browser is Firefox, Mouse is HP M-S34. I tried it IE and still the same. Only happens when I am typing in a thread.

    I have to run but will rund Ad-aware, Spybot and post HJT.

    Dan
  • rollingdan
    edited July 2004
    Just ran Ad-aware 6. How do I know which one to quarantine?

    Dan
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited July 2004
    Quarantine everything that AA6 finds....
  • rollingdan
    edited July 2004
    Ok, quarantined everything in AD 6, quarantine 2 items in spybot and here is my hjt log. Once you tell me what to fix on my hjt log, should I boot in safe mode, run hjt again and then fix? Is that the procedure or do it just do it in normal mode? Here's the log:

    Dan
    Thx alot for your help!

    Logfile of HijackThis v1.97.7
    Scan saved at 4:04:44 PM, on 7/25/04
    Platform: Windows 98 SE (Win9x 4.10.1998A)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\PROGRAM FILES\REALVNC\WINVNC\WINVNC.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
    C:\WINDOWS\SYSTEM\HIDSERV.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMKEYBD.EXE
    C:\WINDOWS\SYSTEM\HPSYSDRV.EXE
    C:\WINDOWS\SYSTEM\USBMMKBD.EXE
    C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
    C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
    C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\KEYBDMGR.EXE
    C:\PROGRAM FILES\NETROPA\ONSCREEN DISPLAY\OSD.EXE
    C:\PROGRAM FILES\NETROPA\ONE-TOUCH MULTIMEDIA KEYBOARD\MMUSBKB2.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\HJT\HIJACKTHIS.EXE

    N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.yahoo.com/"); (C:\Program Files\Netscape\Users\dcote\prefs.js)
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
    O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - C:\PROGRAM FILES\IPSWITCH\WS_FTP PRO\WSBHO2K0.DLL
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN\YCOMP5_3_12_0.DLL
    O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [Keyboard Manager] C:\Program Files\Netropa\One-touch Multimedia Keyboard\MMKeybd.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [USBMMKBD] usbmmkbd.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Marketing Tips Messenger] C:\WINDOWS\Marketing Tips Messenger.exe
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\RunServices: [Hidserv] Hidserv.exe run
    O4 - HKLM\..\RunServices: [WinVNC] "C:\PROGRAM FILES\REALVNC\WINVNC\WINVNC.EXE" -service
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
    O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
    O9 - Extra button: Enjoy It (HKLM)
    O9 - Extra 'Tools' menuitem: Enjoy It (HKLM)
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O12 - Plugin for .bcf: C:\PROGRA~1\INTERN~1\Plugins\NPBelv32.dll
    O12 - Plugin for .avi: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) - http://a840.g.akamai.net/7/840/5805/v1503/www.contentwatch.com/audit/includes/ContentAuditControl.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37865.2130902778
    O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/2281c2d313b7bd8e9f04/netzip/RdxIE601.cab
    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - http://63.123.76.231:8000/ARVIEW2.CAB
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/0fb5e03023def1/housecall.antivirus.com/housecall/xscan53.cab
    O16 - DPF: {21F49842-BFA9-11D2-A89C-00104B62BDDA} (ChartFX Internet Control) - http://41.secure-session.com/download/CfxIEAx.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
    O16 - DPF: {40289096-9F72-4A04-BCB3-E434ECDCEE33} (AppDLCtrl Class) - http://download.howudodat.com/chatterbox/download/appdl.cab
    O16 - DPF: {1F3917D3-88D4-4DD6-ADED-BEB4FE9F88A9} (ActiveFormX Control) - http://www.iprotalk.com/components/IproTalk.cab
    O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
    O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) - http://download.microsoft.com/download/PowerPoint2002/Install/10.0.2609/WIN98MeXP/EN-US/msorun.cab
    O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
  • dodododo Landisville, PA
    edited July 2004
    About the mouse issue, if its USB, when you are typing and its jumping around, unplug it and see if the jumping continues.

    ~dodo
  • rollingdan
    edited July 2004
    dodo wrote:
    About the mouse issue, if its USB, when you are typing and its jumping around, unplug it and see if the jumping continues.

    ~dodo
    unplugged it, no difference.

    Dan

    PS Can anyone help me regarding my HJT log above? I don't want to do anything until I have fix the necessary files. I'm ok with the vibrating cursor as it only appears when I am typing here. No big deal.
Sign In or Register to comment.