Hearing USB Connection Alerts

Discussion in 'Malware Help (A Specialist Will Reply)' started by goliano, Apr 17, 2006.

  1. goliano

    goliano Corporal

    I have done all the steps in READ & RUN ME FIRST Before Asking For Support.

    Every now and then, without reason, I hear the alert sound you get when plugging a peripheral into a USB port or powering up the printer. I hadn't plugged anything in and had not switched on my printer... there was no delay involved, either. So, I figured I'd check to see if there was anything malicious on my system.

    Log files are attached.

    Peace!
    Goliano
     

    Attached Files:

    goliano, Apr 17, 2006
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You have a Wareout infection!

    Look in Add/Remove programs for UnSpyPC and uninstall if found.

    Please download FixWareout from one of these sites:
    http://downloads.subratam.org/Fixwareout.exe
    http://swandog46.geekstogo.com/Fixwareout.exe
    • Save it to your desktop and then run it by double clicking on it. It creates a folder named c:\fixwareout.
    • Click Next, then Install.
    • Then make sure Run fixit is checked (this runs C:\fixwareout\fixit.bat). And then click Finish.
    • The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so.
    • Your system may take longer than usual to load; this is normal.
    • When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items if they still exist:
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    O17 - HKLM\System\CCS\Services\Tcpip\..\{19502907-7A86-4108-A00D-4AC24357D02D}: NameServer = 85.255.113.149,85.255.112.111
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4EBEDCBF-85E0-4175-A74D-433BB7180A58}: NameServer = 85.255.113.149,85.255.112.111


    After clicking Fix Checked, close HijackThis, and click OK to proceed.

    At the end of the fix, reboot into safe mode and use Windows Explorer to double check for the below files and delete if found:
    c:\documents and settings\roweg\favorites\Adult <--- delete the whole folder or file if found
    C:\Program Files\UnSpyPC <--- delete the whole folder if found


    Now reboot into normal mode and please attach the contents of the logfile C:\fixwareout\report.txt

    There could be additional cleanup to do from Wareout and it the log will let us know.

    Also attach a new HijackThis log.
     
    chaslang, Apr 18, 2006
    #2
  3. goliano

    goliano Corporal

    Hijackthis did not launch automatically after following the prompts, so I started it manually.

    Here are the logs.

    Thanks.
     

    Attached Files:

    goliano, Apr 18, 2006
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looks good now! How is it working?
     
    chaslang, Apr 18, 2006
    #4
  5. goliano

    goliano Corporal

    So far, so good. Thanks.

    Was the Wareout infection causing those alert sounds? What exactly was happening behind the scenes?
     
    goliano, Apr 18, 2006
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It's possible! Since it can redirect you thru other sites/servers in the Ukraine, it may have been causing sounds as cookies or other items were being added to your PC.

    If you are not having any other malware problems, you should work thru the below link:

    How to Protect yourself from malware!
     
    chaslang, Apr 19, 2006
    #6

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds