Need help to identify virus\rootkit or whatever

Unknown

Ok i have this problem and i cant solve it myself so i hope someone or some people here can ?????


Two weeks ago on thursday i had strange activity whilst playing warcraft eg. character doing weird things like running backwards etc so when i eventually crashed to desktop (it wouldnt let me escape etc) i found keys on the keyboard had been remapped like the side button on the mouse was now opening webpages instead of being a forward button.


Also i noticed the sound had been muted ??? Remember this as it appears later then i crashed the automatic updates then stopped me accessing the internet.


So i was running AVG Pro with Nvidia Firewall and Nforce manager from my fatality motherboard so ran a scan with AVG and it came up clean yet i knew there was something there.


So i formatted C: and reinstalled but this time i switched to nortons 360 v2.0.


Come 8pm last night (thursday) the same stuff started to happen when i went to play warcraft i noticed 8 search windows open for windows explorer so i shut them all down and went and did something else and came back an hour later and the same thing had happened i also noticed thatthe sound had been muted as well ????


Same symptoms as before happening at exactly the same time of day 2 weeks apart ????


So i ran a nortons virus scan and nothing, ran spybot nothing, ran lavasoft nothing, ran fprot rootkit detector nothing, ran sophos rootkit detector nothing


So i dont know what is up with my system for the past 2 weeks but this is pulling my hair out


So if anyone out there can help me i would be grateful

Katana

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe

---

It sounds like one of the files that you are using for WOW is infected.


Click here to download HJTinstall.exe

• Save HJTinstall.exe to your desktop.
• Double click on the HJTinstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\Hijack This.
• Click I accept
• Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
• Click Save to save the log file and then the log will open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Come back here to this thread and Paste the log in your next reply.
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Installed Programs

Please could you give me a list of the programs that are installed.

• Start HijackThis
• Click on the Misc Tools button
• Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.



Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


**Note**

To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Veka

This topic is now closed due to inactivity. If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

If it has been 10 days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, this topic will not be reopened. If you still require help, please start a new topic and include a fresh HijackThis log and a link to this thread in your new topic.

If you are not the user who started this thread, you must start your own Thread instead