Major Crisis! Svchost.exe.mpmd/Winog Trojan/RuntimeError + more..

Discussion in 'Malware Help (A Specialist Will Reply)' started by AlwaysInfected, Jan 25, 2008.

  1. AlwaysInfected

    AlwaysInfected Private First Class

    Now please bare with me n if u are scared by the size of this message be assured it is pretty well written, Easy to follow and as thoroughly descriptive as possible!
    If not now, please read when u have a minute! Thank You :eek:

    --------------------------------------------------------------------

    After 8 days of dealing with a computer that had no protection besides it's firewall, Stubbornly n Ignorantly knowing but disregardingly downloading an "exe" file from a "Keygen" site :cry Ever since a reboot from that dreaded night my issues haven't ceased!
    I brought my laptop to a shop out here on the Islands. (Im In the Azores) on a friday early afternoon. I figured a thorough virus scan would do the trick n was much needed (since like i said i was running with no AV or AS prior but was doing well as far as no problems nor lag till that exe DL/Extraction)

    Anyhow I bring him the laptop at around 1:30pm Fri. I figure for a thorough AV/AS scan he should surely get it done today depending on how busy he is n if not it sure surely be allset by no later then Sat. night.

    So Tuesday 4:30pm rolls around! No phonecalls. I go there to find him sitting at his desk on a laptop with mine still in its case on the front chair of his desk untouched!!!!!!!!!
    Im like whats' going? he just looked at me like a kid with his hand caught in a cookie jar except with no shame.

    I threatened his life (well not really) I just openly described my anger n discontent.
    He then proceeds to plug in his usb Drive, install avg, Reg Mechanic & SpyBot Search & Destroy.
    He cleans out whatever those things detect in front of me (I wouldn't leave) after about 2 hours n some issues having been detected he reboots. I tell him to try going online (which is where my major issue was) everything looked cool.
    So whateva I payed him hs E25 n leave.

    So i get home. On windows startup i get this beige popup error for "awtttx.exe" or something of the sort. Im like wtf?!?!

    Not only this, I have the strangest error/problem where when i drag any file in or out of a folder Windowsinstaller pops up the installer box for "Easy Cd & DVd creator 6" :confused
    Doesn't matter what i drag, txt file, mp3, app, whateva right before it drops into whateva i drag it into to perform the action the windows installer comes up for the easy cd installation.
    I did remote access with 2 tech friends just to show them n they both were baffled n laughed.

    So we proceeded to uninstall Roxio Easy cd from "Add Remove" ( i don't need it anyhow) everything was successfully removed but the folders. I then manually removed those but there was one file not wanting to be removed cuz of copyright Bs so i deleted it in Safe Mode it was "Shellex.exe or something of the sort from the roxio software.

    I thought i was golden, i reboot drag something in to something n bam, again!

    The last oddball error is I get a runtime error pop box on windows shutdown right after "Saving Settings" at the blue windows screen n right before it actually turns off. Says runtime error n the file directory if im not mistaken is win32 folder svchost.exe

    I had neither of these 3problems prior to going to the tech n him doing his scan or whatever that i knew of.

    Now onto the real/Original issue.

    My reason for going in was after the night of the infamous exe file DL from that keygen site after that shutdown on my next reboot i tried to sign on line n was successful for about 20 seconds n got the infamous (Generic Host Process Win32 services) in the error log or signature it had svchost.exe.mdmp n another file. I don't recall the other now it was a txt file tho n started with at if i can recall correctly.

    I rebooted n rebooted prolly 50 times that day I ran Avg n all the AV/AS apps the tech guy had installed on my system atleast 6 times over n over not only did i find over 100 more malicious issues, torjans etc after he had claimed he cleaned things out thoroughly but the online connection issue hadn't been resolved at the shop nor did my further scanning at home resolve it!

    Now heres the Zen riddle!

    All day after 8 hours str8 of scanning, registry cleaning n rebootin in attempts to get online n get this potential virus cleaned if it is one I still couldnt get online for the love of god.

    So i pass out, go to sleep, wake up about 3:30 am open windows sign on, open mozilla & IE n i get online with no problems!! everything seems to be running good, i stay online for most of the day till svchost's running processes run the cpu Usage through the roof n my laptop shuts down!

    When i restart Generic host process is back at it for the rest of the day! now im really confused! Again i spend hours scanning, signing on after lots of reboots n using the few minutes i have between the Generic host error pop n the system countdown shutdown to research with google about the issues in hopes of finding a resolve.

    Later that night, I pass out wake up about 5am open windows, whaddya know? Im online again! this time i manage my processes n keep the laptop cool enough to stay online for over 10 hours in fear if i rebooted id'e lose my online activity again. This is when i remote accessed n had a friend of mine take a look at things. He said he was stumped.

    I did have an issue where i could not Update windows, he said this was most likely the issue. We disconnected, i further researched with the error # provided on nonupdating windows error n read i needed to uninstalll wininstaller n reinstall it from MS. I did this n i could finally update still nothing! Generic host etc...

    So here I am on my 3rd day online from my first boot of the day.

    Heres what Iv'e scanned with in the past 4 days.
    Avg 7.5
    Adaware Se Pro.
    Trojan Hunter
    Registry Mechanic
    Nod32 AV/AS

    I also have the "wigon trojan" that Nod32 pops when i log on with my dsl connection everytime after restart! I was thinking maybe it was catching the "generic Host process"?
    prolly not.

    My comp is pretty normal far as speed wise, no lag or pop up issues just the Easy Cd installer thing when i drag a file into anything, the Runtime error/svchost.exe pop up right before shutoff n the Generic Host Process win32 services/ svchost.exe.mdmp when i log on most of the time.

    I am posting this in hopes that these issues are potentially resolvable without needing a reformat.

    Another solution i came across on the web was Run>sfc /scannow n do that with my OS disc n let it copy any files but i didnt wanna do that without being sure it was effetive and unharmful to my system.

    Thanks for sticking it out n GodBless,
     
    AlwaysInfected, Jan 25, 2008
    #1
  2. AlwaysInfected

    AlwaysInfected Private First Class

    Heres a new one... 43 Iexplorer.exe running in process?!!?!?!

    Today or just now i noticed my task manager has 86 process running under 20% cpu usage n about 40+ Iexplorer.exe's :cry with no Explorer browser open!!!
    http://img3.freeimagehosting.net/uploads/de373c6718.jpg
     
    AlwaysInfected, Jan 25, 2008
    #2
  3. AlwaysInfected

    AlwaysInfected Private First Class

    Re: Heres a new one... 43 Iexplorer.exe running in process?!!?!?!

    Holy ****, im now at 96 processes n over 60 Iexplorer.exe's Please help soon!!! :cry

    Im sure this all related to my first post I can't understand tho, i ran lots of AS/AV's n cleaned alot aswell. I even ran Adaware in safe mode.:(
     
    Last edited by a moderator: Jan 25, 2008
    AlwaysInfected, Jan 25, 2008
    #3
  4. Lev

    Lev MajorGeek

    Re: Heres a new one... 43 Iexplorer.exe running in process?!!?!?!

    Welcome to MajorGeeks.com!

    Please follow the instructions in the below link and attach the requested logs when you finish these instructions.

    Read & RUN ME FIRST Before Asking for Support
     
    Lev, Jan 25, 2008
    #4
  5. AlwaysInfected

    AlwaysInfected Private First Class

    Re: Heres a new one... 43 Iexplorer.exe running in process?!!?!?!

    Uh.. huh? My windows is XP i assume i go there n download all the "tools"?
    I just read through it all n i dont quite understand how to work "MGtools" n the toggle system restore.

    ALso im afraid to run combofix n lose my connection. The reason is in my "Major Crisis thread.

    (I just heard the blip sound of the Iexplorer.exe popping a new Iex task in my task manager) :cry
     
    AlwaysInfected, Jan 25, 2008
    #5
  6. DavidGP

    DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

    Hi


    The Steps are very clear, just follow one at a time and read all the install and running instructions ( tip is to print them out and tick off each one when you have completed ) for each scan.

    As for System Restore, the guide tells you to only toggle this once your PC is free from malware, so do not do this yet ( also their are clear instructions in the guide on how to do this in XP ).

    If not following the guide in fear of loosing connection, then your sadly likely to be still infected and it will be hard to help you, with out the logs being attached from the guides steps as listed by LEV above.



    Merged your two threads together as you will nto get help quicker by posting multiple threads and reason is here Don't Bump! It Only Hurts You!!!
     
    DavidGP, Jan 25, 2008
    #6
  7. AlwaysInfected

    AlwaysInfected Private First Class

    Well i just spent the last 4 hours scanning in windows safe mode with Adaware n Spybot. Spybot found a few things mostly cookies Adaware found 98 issues including a rootkit n some malware virus's

    Im not sure how to get proper "logs" and for what. I don't even think i know what a log is n what it's for.

    Nod32 catches a win32 Wigon trojan everytime i sign on n it just caught a NBT thing aswell.

    I wasn't trying to bump anything i figured the Iexplorer was a seperate issue so i actually figured by making its own thread i wouldn't look like i was bumping this one.

    I am just hesitant on the proceedures in the thread and and don't wanna mess anything up.
    Especially the MGtools. I use firefox. Whenever i DL something the only options i get is SAVE or Cancel so it auto saves to desktop how i can i change it to go where the read me says n where is my "root folder" or the appropriate folder it needs to go in located?
     
    AlwaysInfected, Jan 25, 2008
    #7
  8. AlwaysInfected

    AlwaysInfected Private First Class

    :cool
    After using Combofix, n rebooted in finding some things to delete, when i came back on Firefox opened up crazy faster than usual n Nod32 did not detect wigon trojan like usual!!!!!!!!!!! :drool:drool

    Heres the log for Combo fix, i dunno how to get a log for Spybot i just did about 30 minutes ago in safe mode n i will try n get my last log from avg.

    EDIT:

    Well i didnt seem to be able to find my results from AVG the other night. I went n uninstalled Nod32 tho, reinstalled AVG n exported my Virus Vault. ;)

    I assume i should mess with MgTools until u guys verify im malware virus free, also let me know about how to save it n exactly where when ready as stated above.

    Thus far combo fix seems like the miracle cure!!! No more Generic Host process on sign on and my windows loads fast as do my programs open ever so quickly!

    EDIT # 2

    I assume and am now confident my last problem is an error I figured i would print screen during the process.
    I used the example of (dragging the avglog file attatched here into my "Security Appz" folder. Notice how dragging files into folders initiates the installer to attempt to install Easy CD which by the way is wholly deleted to the best of my knowledge.

    http://img3.freeimagehosting.net/uploads/81117079a3.jpg
    :confused:confused
     

    Attached Files:

    AlwaysInfected, Jan 25, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to attach the MGlogs.zip file that was requested per the instructions in the READ & RUN ME. You are still infected.
     
    chaslang, Jan 26, 2008
    #9
  10. AlwaysInfected

    AlwaysInfected Private First Class

    Sorry bout that!

    My other logs are in my last post under the screen shot.
     

    Attached Files:

    AlwaysInfected, Jan 26, 2008
    #10
  11. AlwaysInfected

    AlwaysInfected Private First Class

    AlwaysInfected, Jan 26, 2008
    #11
  12. AlwaysInfected

    AlwaysInfected Private First Class

    sorry for the bump but 4th page? :cry

    Incase the tech guy shows up at the house today i wanna have this issue resolved so i dont have to give the laptop to him n have to pay for something that seems to be already fixed for the most part thanks to Major geeks i got my logs up.

    Thanks.
     
    AlwaysInfected, Jan 27, 2008
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    All this did was cost you another day of waiting. See the sticky thread: Don't Bump! It Only Hurts You!!!

    It does not matter what page you are on. We work from oldest to newest and we could have been working on page 5 or 6 (or could have even been close to your post on page 4). It only takes about 1 day to for a new post to go all the way down to page 5 or 6.

    Shutdown Ad-Aware's Ad-Watch before doing the below or it could get in the way.


    Uninstall the below old versions of software:
    Java 2 Runtime Environment, SE v1.4.2
    Java(TM) 6 Update 2
    Java(TM) 6 Update 3
    Viewpoint Media Player <-- should have been uninstalled in step 0 of the READ ME


    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {B8E4F58A-EB75-4DBA-9B1E-DE0478ABFA38} - blank (file missing)
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - blank (file missing)
    O20 - Winlogon Notify: winlzi32 - winlzi32.dll (file missing)
    O20 - Winlogon Notify: wvusqpn - wvusqpn.dll (file missing)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    After clicking Fix, exit HJT.


    Now we need to use ComboFix to remove a bunch of malware files.
    • Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
      • If it is not on your Desktop, the below will not work.
    • Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    RenV::                                                                           
----a-w            39,792 2008-01-22 17:55:24  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w           335,872 2008-01-18 01:21:12  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
----a-w           185,632 2008-01-22 17:55:23  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w            65,536 2008-01-22 17:55:17  C:\Program Files\Common Files\Roxio Shared\System\EngUtil .exe
----a-w           700,416 2008-01-22 17:55:39  C:\Program Files\Creative\Sync Manager Unicode\CTSyncU .exe
----a-w            49,152 2008-01-22 17:55:19  C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w           241,664 2008-01-22 17:55:20  C:\Program Files\HP\hpcoretech\hpcmpmgr .exe
----a-w           184,412 2008-01-22 17:55:20  C:\Program Files\HPQ\Default Settings\cpqset .exe
----a-w            45,056 2008-01-22 17:55:19  C:\Program Files\HPQ\Notebook Utilities\hptasks .exe
----a-w           282,624 2008-01-22 17:55:20  C:\Program Files\HPQ\Notebook Utilities\TvNow .exe
----a-w           102,400 2008-01-22 17:55:20  C:\Program Files\HPQ\One-Touch\OneTouch .EXE
----a-w           132,496 2008-01-22 17:55:24  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w           188,416 2008-01-17 21:46:43  C:\Program Files\Logitech\Video\ISStart .exe
----a-w            65,536 2008-01-17 20:49:03  C:\Program Files\Logitech\Video\LogiTray .exe
----a-w         1,460,560 2008-01-17 16:46:36  C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe
----a-w           610,304 2008-01-22 17:55:19  C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w           110,592 2008-01-22 17:55:16  C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
----a-w           866,816 2008-01-22 17:55:30  C:\Program Files\Thomson\SpeedTouch USB\Dragdiag .exe
----a-w            36,352 2008-01-22 17:55:23  C:\Program Files\Winamp\winampa .exe
    • Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    • At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    • You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    • Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    • Follow the prompts.
    • When it finishes, a log will be produced named c:\combofix.txt
    • I will ask for this log below
    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.


    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs:
    • C:\ComboFix.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jan 27, 2008
    #13
  14. AlwaysInfected

    AlwaysInfected Private First Class

    Wow man, Im sorry. I didnt not mean to be a burden. I go on many forums n just did not understand how things work here far as responding.

    Thank you guys so much for taking the time out of your lives to help people out on your time. Its a true blessing.

    This stuff here..

    and also the stuff in the "Code" Ren V section is that all things u aquired from you analysis from the logs?

    If so thats cool man, thats some skill n talent. I am getting to it now n will be back with the logs.

    N um... :eek: Since then ive installed 2 new things on my comp. 2 apps from www.Bootskin.com :( hopefully you don't see anything outa the ordinary in my next log.

    Also how often should i run reg mechanic and do you think this last process will fix that error on the screen shot from my drag file to folder issue?

    Peace n blessings kind sir.
     
    AlwaysInfected, Jan 27, 2008
    #14
  15. AlwaysInfected

    AlwaysInfected Private First Class

    Well sir, I dunno how u do it. I noticed up top this on mgtools initiation that u designed it. Pure genious u n your tools.

    Everything seems alot more ridiculously responsive. especially my start menu actions n arrow actions.:yum

    My last n only odd problem i have it seems is that damned error when i drag files in or out of folders.
    Look at the screen shot in refference when u have a minute sir. (Hopefully this issue can be deciphered and doesnt require a reformat)

    Oh yea CCleaner is amazing, Just wow. I immediately deleted RegMechanic.
    Id'e like to know a few other things aswell I have. AdAware SE Pro, Avg, Ccleaner (now) and Spybot S&D installed. In a seperate folder i have all the setups for those programs plus Trojan Hunter and Nod32.

    You think i should keep AVG or replace it with Nod32 as an installed AV app?
    Should i keep Adaware n Spybot or just one or do they serve diff purposes?

    Also is there any issues that may affect the actual program by deleting the setup exe's? such as Java setup on my desktop? If i delete it wont effect the app correct?

    What preventative maintenance tasks do you recommend i take to keep my system running clean n out of harms way?
    What exactly was ViewPoint media?

    Here are my logs sir.
    Thank you & GodBless,
    PS. you guys have a donations section? id'e like to donate in the future when i'm able if possible.
     

    Attached Files:

    AlwaysInfected, Jan 27, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You did not uninstall one of the old Sun Java versions as requested and then install the new version. You still have Java(TM) 6 Update 3 which is old. You need to get updates.

    Reg Mechanic is not a tool used in the Malware Forum and I don't suggest using registry tools on any regular basis other than using a tool to do a registry backup. You can discuss tools like this in the Software Forum.

    No we do not have a formal donation process. You can go to the majorgeeks.com main page and purchase Geek Wear if you want to help support the site.


    Your logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN
      • Now type combofix /u in the runbox and click OK.
      • Note: The space between the X and the /U, it must be there.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.
    9. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    10. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    11. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    12. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    13. After doing the above, you should work thru the below link:
     
    chaslang, Jan 27, 2008
    #16
  17. AlwaysInfected

    AlwaysInfected Private First Class

    Sir, I went to my adduninstall thingy in control panel n uninstalled all the java updates n main app.

    When i ran all the stuff mgtool n combo i came back online n googled Java Sun n went to the main site n DL'd what i thought was the newest version. My bad man what version do i need?

    Also what do you have to say about my drag n drop error? when i ever i drag n drop in or out of folders I get the install box for roxio cd n dvd creator n have to click cancel 2wice before it goes away. ITs super annoying.

    I will get to the final processes.

    Thanks again Chaslang, u will not be forgotten!
     
    AlwaysInfected, Jan 27, 2008
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I did not ask you to Google it. I gave you the link in my fix. You need to follow the instructions (in msg # 13) as they are written.


    Post in the Software Forum. Sounds like you have an issue with their direct disk writing software.
     
    chaslang, Jan 27, 2008
    #18
  19. AlwaysInfected

    AlwaysInfected Private First Class

    AlwaysInfected, Jan 27, 2008
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome.

    If you are referring to the READ ME, it is always best to refer to the current online version. If you work from an old version, you may not be doing what we currently want. As malware changes, so do the procedures. ;) Your browser can always be shutdown at the appropriate points.
     
    chaslang, Jan 27, 2008
    #20
  21. AlwaysInfected

    AlwaysInfected Private First Class

    lol I meant msg13 :p

    Thanks again sir.
     
    AlwaysInfected, Jan 27, 2008
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. Surf safely.
     
    chaslang, Jan 27, 2008
    #22

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds