ipconfig.exe box just appears a fraction of a second

[Peterwolfe]

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

13.05.2010 07:31:33
mbam-log-2010-05-13 (07-31-33).txt

Scan type: Full scan (C:\|)
Objects scanned: 174484
Time elapsed: 52 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[Peterwolfe]

must be an interesting item with 149 watchers...lol..

by the way, will soon leave XP for W7 and will replace all my other necessary software from XP with freeware...lolworks great

[SuperDave]

I'd like us to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[Peterwolfe]

well, WHEN the ESET finalizes its findings in a couple of hours (it's have been running for the last 3 hours), I will send the reportlog. I started with C:\ and at the same time had AVG, MBAM, spybot and SuperAS running and only ESET caught 2 sob's within 30 seconds....HTML/lframe.B.Gen Virus og WIN32/Bagle.gen.zip.virus but after that its a quiet run without any sobs....lol...and I have 3 internal HD's, so....

See I have the same type of PC as you have...AMD Athlon 3200+, 2.4Ghz, 3 Gb RAM. It seems the XP Firewall is not good enough, but I had Sygate until it was sold to Symantec and in the end it started to slow down my PC so, with tears in my eyes, I had to uninstall it...so W7, there I have the same W7 firewall and the same defences as in XP, so 100% safe I do not feel...any suggestions?

Hope this little problem will learn the up to now 210 "watchers" something. Guess the name SuperDave is well know in the universe now..hahahahaha....and it shows nobody knows it all or is invulnerable...

[Peterwolfe]

6 hour mark passed....caught 4 which my other defences didnt!!!! WIN32/stuff again....almost ready with my 2d HD, then the 3d coming up, this might take some more hours, but well, we will get rid of ALL sh...I hope

Interest up in 225 "peeping toms...lol"...lol

Screening last HD; found 7(after all was checked by my usual/regular defences), mostly the HTML/lframe.B.Gen Virus stuff and 1 worm...

checkingtime: close to 6 hours and 30 minutes

[BC_Programmer]

6 hour mark passed....caught 4 which my other defences didnt!!!! WIN32/stuff again....almost ready with my 2d HD, then the 3d coming up, this might take some more hours, but well, we will get rid of ALL sh...I hope

Interest up in 215 "watchers"...lol

Views != watchers.

[Peterwolfe]

here is the eset-log....found some of the real "buggers" my above mentioned defences didnt report!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
***********************************************************************************************
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=d7c9fc2dfb25154ab02c44cda6fe90e6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-05-14 02:25:56
# local_time=2010-05-14 04:25:56 (+0100, W. Europe Daylight Time)
# country="Norway"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 18873029 18873029 0 0
# compatibility_mode=1024 16777175 100 0 16580740 16580740 0 0
# compatibility_mode=8192 67108863 100 0 145 145 0 0
# scanned=152373
# found=8
# cleaned=0
# scan_time=33441
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DNSFlushcws1.zip   Win32/Bagle.gen.zip worm   00000000000000000000000000000000   I
C:\Documents and Settings\Peter\Favorites\Sex and the Single Man\Action36 free mature women sex movies and older women sex pictures!.url:favicon   HTML/Iframe.B.Gen virus   00000000000000000000000000000000   I
E:\Downloads\Warez from 090310\unlocker1.8.8.rar   Win32/Adware.ADON application   00000000000000000000000000000000   I
E:\Downloads\Warez from 090310\Nero 9 AIO Pack (2010MULTI)\Nero BackItUp And Burn 1.2.17b.exe   Win32/Toolbar.AskSBar application   00000000000000000000000000000000   I
E:\FavoritesIE\Sex and the Single Man\Action36 free mature women sex movies and older women sex pictures!.url:favicon   HTML/Iframe.B.Gen virus   00000000000000000000000000000000   I
F:\Favorites\Sex and the Single Man\Action36 free mature women sex movies and older women sex pictures!.url:favicon   HTML/Iframe.B.Gen virus   00000000000000000000000000000000   I
F:\Favorites\specials\Action36 free mature women sex movies and older women sex pictures!.url:favicon   HTML/Iframe.B.Gen virus   00000000000000000000000000000000   I
G:\Users\Peter\FavoritesIE\Sex and the Single Man\Action36 free mature women sex movies and older women sex pictures!.url:favicon   HTML/Iframe.B.Gen virus   00000000000000000000000000000000   I

Its most stuff from my man-hobby...lol...and some from downloaded software I wanted to test and will remove that right away. Almost any pirate-software with keygenes is infected in the keygen...
But......look!!!!!!!!!! Spybot contains bad stuff too....maybe I need to remove Spybot S&D!!!!! and thats unexpected

[SuperDave]

I'll have to admit the that I know nothing about the Windows 7 firewall. I don't know if it protects out-going traffic which is very important.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

====================================================

* Go to Start > Run and type mrt.exe then press Enter on the keyboard).
* (Vista and Windows 7 users go to Start and type mrt.exe in the search box then press Enter on the keyboard.
* Click Next.
* Choose Full Scan and click Next.
* Once the scan is finished click View detailed results of the scan.

Look through the list and let me know if anything was found infected.

This tool will take at least 2 hrs. to run. If anything is found, it should produce a report. I'v never seen a report from this tool. If it is txt format, just copy and paste it. If in another format, copy and paste it in Notepad and send it to me. BTW, those 200 plus watchers may be a lot of hackers looking for ways to devise new infections.

[Peterwolfe]

wow, I learn more and more....will certainly do the mrt stuff.... ...I really want W7 the only MS-stuff on my PC until I have learned Linux...my next phase...lol

any comments on the ESET result? 9 hours of scanning was a real thorough effort...lol. My concern is that the 2 real bugs werent discovered by my defences(part of them are also yours in your system...)...

Hope the 286 viewers have learned a thing or 2...lol

[Peterwolfe]

and of course...THANK YOU SuperDave...you're my heroe

[SuperDave]

The ESET scan did what it's supposed to do but 9 hrs. is a bit too long.

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
=========================================
Please download ComboFix from BleepingComputer.com

Alternate link: GeeksToGo.com

Rename ComboFix.exe to commy.exe before you save it to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools A guide to do this can be found here
Click Start>Run then copy paste the following command into the Run box & click OK "%userprofile%\desktop\commy.exe" /stepdel
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console[/list]

Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:


Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you.  Please include the contents of C:\ComboFix.txt in your next reply.

If you have problems with ComboFix usage, see How to use ComboFix

[Peterwolfe]

well, it had to plow through 1HD 250gigs and 2 others of 500gigs...lol

any reason why you advise to use the Securitycheck and the Combofix? Just a question on behalf of the 340 viewers traveling  "along"...lol ...and me of course

[SuperDave]

The Security Check is to look at what you have on your computer for security. You said that you were concerned how the malware was getting in. This will give me a better idea and the ComboFix is to make sure everything is clean.

[Peterwolfe]

ok, boss..lololol...will perform...

[Peterwolfe]

 Results of screen317's Security Check version 0.99.4 
 Windows XP Service Pack 3 
 Internet Explorer 8 
``````````````````````````````
Antivirus/Firewall Check:
 Windows Firewall Enabled! 
 AVG Free 9.0   
 ESET Online Scanner v3   
 Antivirus up to date! 
```````````````````````````````
Anti-malware/Other Utilities Check:
 Malwarebytes' Anti-Malware   
 HijackThis 2.0.2   
 CCleaner     
 Wise Registry Cleaner Professional V5.12
 Java(TM) 6 Update 20 
 Java(TM) 6 Update 18 
 Out of date Java installed!
 Adobe Flash Player 10.0.45.2 
Adobe Reader 8.2.2
Out of date Adobe Reader installed!
````````````````````````````````
Process Check: 
objlist.exe by Laurent
 AVG avgwdsvc.exe
 AVG avgtray.exe
 AVG avgrsx.exe
 AVG avgnsx.exe
 AVG avgemc.exe
````````````````````````````````
DNS Vulnerability Check:
 GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````
****************
and now I own a Recovery Console...lol?? and yes it showed at the next restart!!!!!!
Old Java removed and new Adobe installed...