1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Weird problem

Discussion in 'Windows XP' started by Corvette, Apr 28, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
    Possibly a virus? Or is it a hardware problem?

    I had Win 98 on and my PC automaticaly minimized it opend windows, re open them. When I click on a file it opens it many times. When I am typing soimething it automaticly enters. So I could be on AIM and in the middle of a convo...my mesages would be like

    h
    e
    y
    w
    h
    a
    t
    s

    This problem upsets me. First I thought it was a virus because I been using pal talk a lot and I thought I got one through it. I ran a scan and found nothing. I even ran adaware and spyhunter for spy stuff and it found nothing.

    I reinstalled 98 and it didn't get fixed. So then I formatted C: and put XP on it. The problem did not occure untill one day later. I also scaned for viruses when I put XP on and nothing found.

    So I thought it must be a hardware problem. I thought hey it might be my keyboard, it has been ghay lately. I unlplugged it and the problem still exsited! I did the same for the mouse and I got the same result! So im thinking its something else. What is the problem? Anyone had this? How do I fix?

    P3 800 CPU
    160 Ram
     
  2. dai

    dai

    Joined:
    Mar 6, 2003
    Messages:
    11,198
    run hijack and post the log
     
  3. DFC

    DFC

    Joined:
    Apr 24, 2004
    Messages:
    411
    I had the same problem on a Win98 machine recently. Keyboard and mouse both acted crazy. Mouse acted like had mind of it's own and keyboard was doing same. Swapped out keyboard and all is well. If you can barrow a keyboard to check it out, do.
     
  4. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
  5. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
    Sometimes it happens and sometimes it doesn't *the problem*. When I posted this topic and this reply it obviously isn't
    affecting me now.

    Aight i'll give that a try, the keyboard and mouse. Lets hope it works. Im DLing hijacker now.
     
  6. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
    Tell me what to check and fix:

    Logfile of HijackThis v1.97.7
    Scan saved at 21:10:59, on 28-Apr-04
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\NORTON~1\navapw32.exe
    C:\WINDOWS\System32\msblast.exe
    C:\Program Files\AIM\aim.exe
    D:\Program Files\WinAmp\winamp.exe
    D:\PROGRA~1\WINZIP\winzip32.exe
    C:\Documents and Settings\Hovi\Local Settings\Temp\HijackThis.exe

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [windows auto update] msblast.exe
    O9 - Extra button: AIM (HKLM)
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C6DE8D43-F0EB-472F-9064-FC51318FDB29}: NameServer = 207.251.201.10 207.251.201.11
     
  7. DFC

    DFC

    Joined:
    Apr 24, 2004
    Messages:
    411
    No expert on HiJackThis but pretty sure msblast.exe is no good.

    Removing autostart entries from the registry prevents the malware from executing during startup.

    Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
    In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>Software>Microsoft>
    Windows>CurrentVersion>Run
    In the right panel, locate and delete the entry:
    "windows auto update" = MSBLAST.EXE
    Close Registry Editor.
     
  8. Couriant

    Couriant Trusted Advisor

    Joined:
    Mar 26, 2002
    Messages:
    33,996
    First Name:
    James
    RUn HJT again and check these for fixin

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
    O4 - HKLM\..\Run: [windows auto update] msblast.exe - culprit
    O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab

    Go into safe mode and delete:
    msblast.exe - (you will need to search for this. Most likely in C:\)
    C:\WINDOWS\Java\classes\win32ie4.cab


    Then all should be good.
     
  9. DFC

    DFC

    Joined:
    Apr 24, 2004
    Messages:
    411
    You can find a removal tool HERE for the worm.
     
  10. Couriant

    Couriant Trusted Advisor

    Joined:
    Mar 26, 2002
    Messages:
    33,996
    First Name:
    James
  11. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
    I cant find it in my registry. I also did what u wanted me to do with HJT.
     
  12. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
    Before I do any downloading...I found these with the XP search:

    msblast C:\WINDOWS\SYSTEM32 when I right clicked it it said stuf flike compatability

    MSBLAST.EXE-09FF84F2.pf C:\WINDOWS\Prefetch

    Also im Dling the 4/28 definitions, does it have the worm removal in it?
     
  13. dai

    dai

    Joined:
    Mar 6, 2003
    Messages:
    11,198
  14. Corvette

    Corvette Thread Starter

    Joined:
    Aug 30, 2003
    Messages:
    208
    ok after my last reply I downloaded fixblast and I got this pop up after scanning:

    W32.Blaster.Worm has been ....removed from your pc!
    Here is the report:
    Total # of scaned files: 16347
    Total # of deleted files: 2
    Total # of repaired filed: 0
    The # of viral processes terminated: 1
    The # of registry enteries fixed: 0

    Here is the logfile:

    The process "MSBLAST.EXE" is viral. It is terminated.

    The tool has deleted the viral file "C:\WINDOWS\SYSTEM32\msblast.exe".

    The tool has deleted the viral file "C:\System Volume Information\_restore{5E42B577-5A4E-4B51-BE1A-B4DC09766473}\RP3\A0013174.exe".

    W32.Blaster.Worm has been successfully removed
    from your computer!

    Here is the report:

    The total number of the scanned files: 16347
    The number of deleted files: 2
    The number of repaired files: 0
    The number of viral processes terminated: 1
    The number of registry entries fixed: 0
    The scanning procedure was cancelled.
    The scanning procedure was cancelled.
    The scanning procedure was cancelled.
    The scanning procedure was cancelled.
    The scanning procedure was cancelled.
    The scanning procedure was cancelled.
    The scanning procedure was cancelled.


    ALL OF THOSE CANCELS WAS WHEN I TRIED TO EXIT BECAUSE IT DIDN'T WANT TO GO AWAY LOL

    What do I do next to be sure it's gone? Do I need to do the WInupdate now?

    One question, the symptoms of this worm does not fit my symptoms? I had these on Win 98 and also on XP. But how can it be on 98? It can't.
     
  15. Cris_Cr0ss

    Cris_Cr0ss

    Joined:
    Jan 30, 2004
    Messages:
    820
    ya do a update get AVG free anti-virus link is in my signature and re-post a fresh HJT log.
     
  16. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/224694

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice