Red Sqaures - Free Antivirus Forum

Red Sqaures

BullGuard Antivirus Forum > Bullguard zone > BullGuard Trial users > Red Sqaures

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Tim_Tam
New Member

Date Joined Jun 2005
Total Posts : 7

Posted 2-9-2008 3:49 (GMT +2)

Hi, i've added an attachment because i cant really describe it.
I turned on my computer a few days ago, and realised
that the whole screen was covered with small red sqaures.

They blink, and the only plausible explanation is that it is a virus.
I did a check on AVG and it deleted two trojans
(age of empires game? what the.)

Anyway, ive deleted the trojans and my bullguard trial is over.

Can anyone please help me in this sticky situation?

Thank you!

Image Attachment :

Sqaures.JPG 80KB (image/jpeg)

This image has been viewed 30 time(s).

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13070

Posted 2-9-2008 4:00 (GMT +2)

Hello

I´ve never seen that before. I´ll therefore suggest We see what´s running on Your computer -

Click here - ->> Before posting a log

After You have run the scan tools -

Reboot normally

Post Hijackthis log along with SuperAntiSpyware log, , C: combofix TXT in this topic

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

Tim_Tam
New Member

Date Joined Jun 2005
Total Posts : 7

Posted 2-10-2008 5:32 (GMT +2)

Thanks, i already have most of the cleaners and have cleaned my PC.
Here is my HJT log and ComboFix Log.

*********************************************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:21:42 PM, on 2/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\explorer.exe
D:\Documents and Settings\Quanie!\Desktop\Downloaded Programs\Cleaners\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ptec/defaults/su/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eBayToolbar] D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = D:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: eBay Search - res://D:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202610353437
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://quanie.spaces.live.com/PhotoUpload/MsnPUpld.cab
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

--
End of file - 6622 bytes

ComboFix 08-02.05.3 - Quanie! 2008-02-10 13:17:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.630 [GMT 10:00]
Running from: D:\Documents and Settings\Quanie!\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))
.

2008-02-10 12:39 . 2008-02-10 12:39 <DIR> d-------- D:\Program Files\CCleaner
2008-02-10 12:27 . 2004-08-04 22:00 388,608 --a------ D:\kmd.exe
2008-02-05 19:03 . 2008-02-10 12:18 <DIR> d-------- D:\Documents and Settings\Quanie!\Application Data\AVG7
2008-02-05 19:03 . 2008-02-05 19:03 <DIR> d-------- D:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-05 19:03 . 2008-02-05 19:03 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 19:03 . 2008-02-06 18:01 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\avg7
2008-02-05 19:03 . 2008-02-05 19:03 499,712 --a------ D:\WINDOWS\system32\msvcp71.dll
2008-02-05 19:03 . 2008-02-05 19:03 348,160 --a------ D:\WINDOWS\system32\msvcr71.dll
2008-01-22 17:57 . 2008-02-10 12:28 <DIR> d-------- D:\Documents and Settings\All Users\Application Data\WholeSecurity
2008-01-22 17:49 . 2007-10-11 09:55 6,065,664 -----c--- D:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-22 17:49 . 2007-07-01 13:31 2,455,488 -----c--- D:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-22 17:49 . 2007-07-01 13:36 991,232 -----c--- D:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-22 17:49 . 2007-10-11 09:55 459,264 -----c--- D:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-22 17:49 . 2007-10-11 09:55 383,488 -----c--- D:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-22 17:49 . 2007-10-11 09:55 267,776 -----c--- D:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-22 17:49 . 2007-10-11 09:55 63,488 -----c--- D:\WINDOWS\system32\dllcache\icardie.dll
2008-01-22 17:49 . 2007-10-11 09:55 52,224 -----c--- D:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-22 17:49 . 2007-10-10 20:59 13,824 -----c--- D:\WINDOWS\system32\dllcache\ieudinit.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 03:14 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\LimeWire
2008-02-10 02:43 --------- d-----w D:\Program Files\SUPERAntiSpyware
2008-02-10 02:43 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-09 14:05 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\uTorrent
2008-02-02 02:51 --------- d-----w D:\Documents and Settings\All Users\Application Data\BullGuard
2008-01-22 06:52 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\WholeSecurity
2008-01-07 05:38 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\BullGuard
2008-01-04 04:09 --------- d-----w D:\Program Files\Java
2008-01-03 13:39 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\Ahead
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]
"MsnMsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"Yahoo! Pager"="D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 22:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 16:27 16207872 D:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 20:04 2879488 D:\WINDOWS\SkyTel.exe]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"eBayToolbar"="D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-01-19 20:01 623856]
"NeroFilterCheck"="D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-06 18:02 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="D:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-05 19:03 219136]

D:\Documents and Settings\Quanie!\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - D:\Program Files\LimeWire\LimeWire.exe [2007-09-18 00:19:14 147456]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= D:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
D:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 D:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R2 UxTuneUp;TuneUp Theme Extension;D:\WINDOWS\System32\svchost.exe [2004-08-04 22:00]
S3 gdrv;gdrv;D:\WINDOWS\gdrv.sys [2007-11-04 10:52]
S3 PVUSB;CESG502 USB Driver;D:\WINDOWS\system32\DRIVERS\CESG502.sys [2002-06-12 22:50]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-02-01 07:15:38 D:\WINDOWS\Tasks\1-Click Maintenance.job"
- D:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-10 13:18:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-10 13:18:48
.
2008-01-23 11:47:04 --- E O F ---

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13070

Posted 2-15-2008 10:03 (GMT +2)

Sorry for delay.

No infections in the log´s ;-)

Have You checked Your graphic card drivers recently ? as it is possible You need to update it

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

Charlie B
New Member

Date Joined Feb 2008
Total Posts : 1

Posted 2-18-2008 9:17 (GMT +2)

I don't mean to scare you, but this looks like problem with your video card to me. I've seen similar behaviour before, and it always was because of an overheating video card. Does your pc make more noise than it has done in the past, or maybe even less noise? Both could indicate a problem with fans that are not running properly anymore or even stopped running. If possible, try another video card. Before you do, remove the video card driver, don't reboot but shut down the pc and insert the new card. If you aren't sure how to do this, please find someone who does, to do it for you. Also be cautious that the video card may be hot when the fan stopped working.

Forum Information

Currently it is Monday, October 06, 2008 5:15 PM (GMT +2)
There are a total of 62.545 posts in 15.603 threads.
In the last 3 days there were 20 new threads and 44 reply posts. View Active Threads