Red Sqaures

Posted 2/9/2008 1:49 PM
#59566
User avatar

Tim_Tam Member

Date Joined Nov 2016
Total Posts: 4
Hi, i've added an attachment because i cant really describe it.
I turned on my computer a few days ago, and realised
that the whole screen was covered with small red sqaures.

They blink, and the only plausible explanation is that it is a virus.
I did a check on AVG and it deleted two trojans
(age of empires game? what the.)

Anyway, ive deleted the trojans and my bullguard trial is over.

Can anyone please help me in this sticky situation?

Thank you!
Post attachments:
Sqaures.JPG
Posted 2/9/2008 2:00 PM
#59568
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12974
Hello :smile:




I´ve never seen that before. I´ll therefore suggest We see what´s running on Your computer -






Click here - ->> [color=#0000ff>Before posting a log[/b]





After You have run the scan tools -



Reboot normally



Post Hijackthis log along with SuperAntiSpyware log, , C: combofix TXT in this topic




[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


Posted 2/10/2008 3:32 AM
#59574
User avatar

Tim_Tam Member

Date Joined Nov 2016
Total Posts: 4
Thanks, i already have most of the cleaners and have cleaned my PC.
Here is my HJT log and ComboFix Log.

*********************************************************
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:21:42 PM, on 2/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\RTHDCPL.EXE
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\explorer.exe
D:\Documents and Settings\Quanie!\Desktop\Downloaded Programs\Cleaners\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://red.clientapps.yahoo.com/customize/ptec/defaults/su/*https://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - D:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [eBayToolbar] D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] D:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = D:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: eBay Search - res://D:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - https://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202610353437
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - https://quanie.spaces.live.com/PhotoUpload/MsnPUpld.cab
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

--
End of file - 6622 bytes




















ComboFix 08-02.05.3 - Quanie! 2008-02-10 13:17:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.630 [GMT 10:00]
Running from: D:\Documents and Settings\Quanie!\Desktop\ComboFix.exe
* Created a new restore point

[color=red]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.

((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))
.

2008-02-10 12:39 . 2008-02-10 12:39 d-------- D:\Program Files\CCleaner
2008-02-10 12:27 . 2004-08-04 22:00 388,608 --a------ D:\kmd.exe
2008-02-05 19:03 . 2008-02-10 12:18 d-------- D:\Documents and Settings\Quanie!\Application Data\AVG7
2008-02-05 19:03 . 2008-02-05 19:03 d-------- D:\Documents and Settings\LocalService\Application Data\AVG7
2008-02-05 19:03 . 2008-02-05 19:03 d-------- D:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-05 19:03 . 2008-02-06 18:01 d-------- D:\Documents and Settings\All Users\Application Data\avg7
2008-02-05 19:03 . 2008-02-05 19:03 499,712 --a------ D:\WINDOWS\system32\msvcp71.dll
2008-02-05 19:03 . 2008-02-05 19:03 348,160 --a------ D:\WINDOWS\system32\msvcr71.dll
2008-01-22 17:57 . 2008-02-10 12:28 d-------- D:\Documents and Settings\All Users\Application Data\WholeSecurity
2008-01-22 17:49 . 2007-10-11 09:55 6,065,664 -----c--- D:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-22 17:49 . 2007-07-01 13:31 2,455,488 -----c--- D:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-22 17:49 . 2007-07-01 13:36 991,232 -----c--- D:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-22 17:49 . 2007-10-11 09:55 459,264 -----c--- D:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-22 17:49 . 2007-10-11 09:55 383,488 -----c--- D:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-22 17:49 . 2007-10-11 09:55 267,776 -----c--- D:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-22 17:49 . 2007-10-11 09:55 63,488 -----c--- D:\WINDOWS\system32\dllcache\icardie.dll
2008-01-22 17:49 . 2007-10-11 09:55 52,224 -----c--- D:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-22 17:49 . 2007-10-10 20:59 13,824 -----c--- D:\WINDOWS\system32\dllcache\ieudinit.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-10 03:14 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\LimeWire
2008-02-10 02:43 --------- d-----w D:\Program Files\SUPERAntiSpyware
2008-02-10 02:43 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-09 14:05 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\uTorrent
2008-02-02 02:51 --------- d-----w D:\Documents and Settings\All Users\Application Data\BullGuard
2008-01-22 06:52 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\WholeSecurity
2008-01-07 05:38 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\BullGuard
2008-01-04 04:09 --------- d-----w D:\Program Files\Java
2008-01-03 13:39 --------- d-----w D:\Documents and Settings\Quanie!\Application Data\Ahead
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="D:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]
"MsnMsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"Yahoo! Pager"="D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 22:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-05-18 16:27 16207872 D:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 20:04 2879488 D:\WINDOWS\SkyTel.exe]
"QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05 257088]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"eBayToolbar"="D:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-01-19 20:01 623856]
"NeroFilterCheck"="D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"AVG7_CC"="D:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-06 18:02 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="D:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-02-05 19:03 219136]

D:\Documents and Settings\Quanie!\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - D:\Program Files\LimeWire\LimeWire.exe [2007-09-18 00:19:14 147456]

D:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 18:05:56 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= D:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
D:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 D:\Program Files\SUPERAntiSpyware\SASWINLO.dll

R2 UxTuneUp;TuneUp Theme Extension;D:\WINDOWS\System32\svchost.exe [2004-08-04 22:00]
S3 gdrv;gdrv;D:\WINDOWS\gdrv.sys [2007-11-04 10:52]
S3 PVUSB;CESG502 USB Driver;D:\WINDOWS\system32\DRIVERS\CESG502.sys [2002-06-12 22:50]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

.
Contents of the 'Scheduled Tasks' folder
"2008-02-01 07:15:38 D:\WINDOWS\Tasks\1-Click Maintenance.job"
- D:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2008-02-10 13:18:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-10 13:18:48
.
2008-01-23 11:47:04 --- E O F ---
Posted 2/15/2008 8:03 AM
#59694
User avatar

Touch Advanced member

Date Joined Nov 2016
Total Posts: 12974
Sorry for delay.




No infections in the log´s ;-)





Have You checked Your graphic card drivers recently ? as it is possible You need to update it

[color=black face="Courier New" sab="311">[2]Click here: Before-posting-a-log[/2][/url]

<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />
[/color]
Do not PM me with logfiles. They will be deleted.


Posted 2/18/2008 7:17 PM
#59806
User avatar

Charlie B Member

Date Joined Nov 2016
Total Posts: 1
I don't mean to scare you, but this looks like problem with your video card to me. I've seen similar behaviour before, and it always was because of an overheating video card. Does your pc make more noise than it has done in the past, or maybe even less noise? Both could indicate a problem with fans that are not running properly anymore or even stopped running. If possible, try another video card. Before you do, remove the video card driver, don't reboot but shut down the pc and insert the new card. If you aren't sure how to do this, please find someone who does, to do it for you. Also be cautious that the video card may be hot when the fan stopped working.
  • Unread posts or replies
  • No unread posts or replies
  • Unread Posts (Read Only Forum)
  • No Unread Posts (Read Only Forum)

Forum Information

Currently it is Wednesday, December 11, 2019, 6:01 AM (GMT +1)
There are a total of 61,750 posts in 13,625 threads.
In the last 3 days there were 0 new threads and 2 reply posts.

Who's online

This forum has 38,552 registered members. Please welcome our newest member, joshep.
There are currently no users on-line.
We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.