• We've upgraded our forums. Please post any issues/requests in this thread.

Malware Issues ...Need help ! :)

Joined
Feb 7, 2010
Messages
1,453 (0.51/day)
Likes
227
System Name 2K Gamer
Processor AMD 8370 @ 4.5GHZ
Motherboard ASUS Pro Gaming / Aura 970
Cooling Corsair H60 AIO
Memory 16GB G. Skill RipJaw @ 1600MHZ
Video Card(s) Zotac AMP! GTX 1070
Storage Samsung 600 Gig HDD (Raid 0 @ 7,500) / WD 1TB Blue @ 7,200 / PNY 128 GB SSD For Linux
Display(s) 27'' ASUS 144MHZ G-SYNC Read 1400p Gaming Monitor / 23'' LG LCD Flatron W2361VG 1080p @ 50,000:1
Case NZXT Source 530
Audio Device(s) Onboard 7.1 HD Realtek
Power Supply 750w Corsair HX
Mouse Cougar Gaming Mouse
Keyboard Saitek Eclipse
Software Windows 10 64bit Education Edition
#1
So, I was downloading converted videos from a Keepvid.com website and I clicked on one of their nasty ad's by accident and now I get this everytime I try to watch a video with ad's on them in Youtube on my Google Chrome browser. Internet Explorer Browser doesn't have this issue.

Image:
Untitled.jpg


It's flow player and I cannot see it in my Unistall/Install manager via Control Panel, so it's hidden.

Here is Hijack This! log:

Code:
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 7:41:20 PM, on 7/12/2012
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16446)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Steam\Steam.exe
C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe
C:\Program Files (x86)\MSI Afterburner\MSIAfterburner.exe
C:\Program Files (x86)\MSI Afterburner\Bundle\OSDServer\RTSS.exe
C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\SysWOW64\rundll32.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\AlexSubri\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {1036AD63-AEAC-460B-9060-C96005D4DC86} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Privacy SafeGuard - {A42D2EB4-DD31-4BB5-8AA5-8D4E04806DBE} - C:\Program Files\PrivacySafeGuard\PrivacySafeGuard.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RemoteControl11] C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe
O4 - HKLM\..\Run: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\AlexSubri\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Steam] "C:\Program Files (x86)\Steam\steam.exe" -silent
O4 - HKCU\..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: CLHNServiceForPowerDVD - Unknown owner - C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe
O23 - Service: CyberLink PowerDVD 11.0 Monitor Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe
O23 - Service: CyberLink PowerDVD 11.0 Service - CyberLink - C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 9986 bytes
I am running Windows Essentials Virus Scanner Full Scan now, I will report when its done scanning.
 

stinger608

Dedicated TPU Cruncher & Folder
Joined
Nov 11, 2008
Messages
9,609 (2.89/day)
Likes
8,485
Location
Wyoming
System Name Dean Machine
Processor Intel 4790K
Motherboard MSI 1150 Gaming mATX
Cooling Corsair H100i and video card custom loop
Memory 16 gigs Crucial Ballistix Tactical Tracer
Video Card(s) Dual liquid cooled HD7970's (Thanks to Norton!!!)
Storage Crucial M4 256 gig SSD
Display(s) Overlord 27" 2560 x 1440
Case Corsair Air 540
Audio Device(s) On board
Power Supply Seasonic modular 850 watt Platinum
Software Windows 10 Pro
#2
Joined
Dec 20, 2010
Messages
652 (0.26/day)
Likes
58
Location
Fresno, CA
System Name LS Vtec B18B1 Bolt Ons
Processor AMD Phenom ii 1045t x6 @ 3.5Ghz OC
Motherboard ASRock 970 Extreme3 R2.0 AM3+
Cooling CM Hyper 212 EVO Push Pull
Memory CORSAIR Vengeance 8GB (2 x 4GB) Black 1600Mhz
Video Card(s) Sapphire 7950 Dual-X
Storage Samsung EVO 250gb SSD/Samsung 500gb 7200 rpm/WD Cavirar Green 1TB
Display(s) Acer H236HLbid IPS
Case NZXT Gamma (Powder Coated Champion White)
Audio Device(s) Creative Lab SB0460
Power Supply NZXT HALE82 V2 550W
Software Windows 7 Ultimate 64bit SP1
Benchmark Scores Vtec
#3
Joined
Feb 7, 2010
Messages
1,453 (0.51/day)
Likes
227
System Name 2K Gamer
Processor AMD 8370 @ 4.5GHZ
Motherboard ASUS Pro Gaming / Aura 970
Cooling Corsair H60 AIO
Memory 16GB G. Skill RipJaw @ 1600MHZ
Video Card(s) Zotac AMP! GTX 1070
Storage Samsung 600 Gig HDD (Raid 0 @ 7,500) / WD 1TB Blue @ 7,200 / PNY 128 GB SSD For Linux
Display(s) 27'' ASUS 144MHZ G-SYNC Read 1400p Gaming Monitor / 23'' LG LCD Flatron W2361VG 1080p @ 50,000:1
Case NZXT Source 530
Audio Device(s) Onboard 7.1 HD Realtek
Power Supply 750w Corsair HX
Mouse Cougar Gaming Mouse
Keyboard Saitek Eclipse
Software Windows 10 64bit Education Edition
#4
Thanks! Malwarebyte fixed it. I didn't realized as well, Privacy SafeGuard 1.1 in my Google Chrome Extension was a problem as well? :-\ The scary part is on their website it says it collects data from your browsing. Well, it sounds like Privacy SafeGuard wasn't really "Private."

Thanks you two for answering. I will check back here if anything out of the norm pops up again.
 

stinger608

Dedicated TPU Cruncher & Folder
Joined
Nov 11, 2008
Messages
9,609 (2.89/day)
Likes
8,485
Location
Wyoming
System Name Dean Machine
Processor Intel 4790K
Motherboard MSI 1150 Gaming mATX
Cooling Corsair H100i and video card custom loop
Memory 16 gigs Crucial Ballistix Tactical Tracer
Video Card(s) Dual liquid cooled HD7970's (Thanks to Norton!!!)
Storage Crucial M4 256 gig SSD
Display(s) Overlord 27" 2560 x 1440
Case Corsair Air 540
Audio Device(s) On board
Power Supply Seasonic modular 850 watt Platinum
Software Windows 10 Pro
#5
Malwarebyte fixed it.
Awesome Alex!!!!! I knew it would LOL. Glad it all got straightened up for ya. Nothing worse than dealing with frigging malware!