suspected w3hph.eye malware replied by Detached @ Mon, 14 Jul 2008 16:39:55 +0800

Detached — Mon, 14 Jul 2008 16:39:55 +0800

Thanks for the reply again, mayi.

Nvm, I'll just skip... As of now.. the lappie's fine... no problem yet.... You're my lappie's savior :D

suspected w3hph.eye malware replied by ndmmxiaomayi @ Mon, 14 Jul 2008 16:36:08 +0800

ndmmxiaomayi — Mon, 14 Jul 2008 16:36:08 +0800

Originally posted by Detached:

How sia? Don't joke liao leh :(

Not kidding. Norton is a huge resource eater.

You can uninstall Norton...

And use this free antivirus - http://www.antivir-pe.com/freet/index.php?id=25&domain=free-av.com

suspected w3hph.eye malware replied by Detached @ Sat, 12 Jul 2008 15:04:25 +0800

Detached — Sat, 12 Jul 2008 15:04:25 +0800

Originally posted by ndmmxiaomayi:

Ask RP not to use Norton.

How sia? Don't joke liao leh :(

suspected w3hph.eye malware replied by ndmmxiaomayi @ Sat, 12 Jul 2008 13:08:46 +0800

ndmmxiaomayi — Sat, 12 Jul 2008 13:08:46 +0800

Originally posted by Detached:

Update!

The lappie has been hanging since the last CF, I could be surfing some sites on IE and the whole screen just freeze up. Running Taskmanager and ending whatever IE, MSN, Explorer.exe and re-running Explorer.exe doesn't solve the problem... die die gotta force shutdown..

The process charge for 84 running processes shown on taskmanager gave me a shock.. RTVscan.exe (which I believe it's the antivirus) is running at 75k and all the usual processes that used to take like couple of hundred memory.. now takes thousands to run.. Total commit charge was capped at 60% when it hung..

Save.Our.Soul!

Ask RP not to use Norton.

suspected w3hph.eye malware replied by ceecookie @ Sat, 12 Jul 2008 00:11:59 +0800

ceecookie — Sat, 12 Jul 2008 00:11:59 +0800

Lol...no matter how strong a virus is, the uber-reformat will remove it

suspected w3hph.eye malware replied by Detached @ Fri, 11 Jul 2008 23:48:04 +0800

Detached — Fri, 11 Jul 2008 23:48:04 +0800

Update!

The lappie has been hanging since the last CF, I could be surfing some sites on IE and the whole screen just freeze up. Running Taskmanager and ending whatever IE, MSN, Explorer.exe and re-running Explorer.exe doesn't solve the problem... die die gotta force shutdown..

The process charge for 84 running processes shown on taskmanager gave me a shock.. RTVscan.exe (which I believe it's the antivirus) is running at 75k and all the usual processes that used to take like couple of hundred memory.. now takes thousands to run.. Total commit charge was capped at 60% when it hung..

Save.Our.Soul!

suspected w3hph.eye malware replied by Detached @ Fri, 11 Jul 2008 23:07:09 +0800

Detached — Fri, 11 Jul 2008 23:07:09 +0800

Couldn't upload it to mediafire, after I clicked on upload - it returned an error page again. What could be the problem? It used to work for me.

Anyway, sent the log to your email. Thanks :D

suspected w3hph.eye malware replied by Detached @ Fri, 11 Jul 2008 18:35:49 +0800

Detached — Fri, 11 Jul 2008 18:35:49 +0800

Gotcha!

working on it now, will update as soon as I'm done :P

Thanks again

suspected w3hph.eye malware replied by ndmmxiaomayi @ Wed, 09 Jul 2008 22:28:32 +0800

ndmmxiaomayi — Wed, 09 Jul 2008 22:28:32 +0800

Download ATF Cleaner and save it to your desktop.

Double click on ATF-Cleaner.exe to run it.

Click on Main at the top.
Tick all the boxes except the Prefetch and Cookies box.
Click on Empty Selected button.

If you use Firefox

Click on Firefox at the top.
Tick all the boxes except Firefox Cookies and Firefox Saved Passwords.
Click on Empty Selected button.

If you use Opera

Click on Opera at the top.
Tick all the boxes except Opera Cookies and Opera Saved Passwords.
Click on Empty Selected button.

Close ATF Cleaner when you are done.

Please download Malwarebytes' Anti-Malware and save it to a convenient location.
Double click on mbam-setup.exe to install it.
Before clicking the Finish button, make sure that these 2 boxes are checked (ticked):
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware will now check for updates. If your firewall prompts, please allow it. If you can't update it, select the Update tab. Under Update Mirror, select one of the websites and click on Check for Updates.
Select the Scanner tab. Click on Perform full scan, then click on Scan.
Leave the default options as it is and click on Start Scan.
When done, you will be prompted. Click OK, then click on Show Results.
Checked (ticked) all items and click on Remove Selected.
After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest.

suspected w3hph.eye malware replied by Detached @ Wed, 09 Jul 2008 21:39:07 +0800

Detached — Wed, 09 Jul 2008 21:39:07 +0800

Originally posted by ndmmxiaomayi:

Email can work?

Copy and paste the the whole log.

Mail is ndmmxiaomayi AT gmail DOT com

AT = @

DOT = .

Remove all the spaces.

Sent :D

Thanks mayi

suspected w3hph.eye malware replied by ndmmxiaomayi @ Wed, 09 Jul 2008 21:18:12 +0800

ndmmxiaomayi — Wed, 09 Jul 2008 21:18:12 +0800

Originally posted by Detached:

The same ol' thing, couldn't disable my antivirus but I still went ahead with running the CFScript.txt.

I couldn't upload the log to mediafire, it returned a page error.

Email can work?

Copy and paste the the whole log.

Mail is ndmmxiaomayi AT gmail DOT com

AT = @

DOT = .

Remove all the spaces.

suspected w3hph.eye malware replied by Detached @ Wed, 09 Jul 2008 21:15:22 +0800

Detached — Wed, 09 Jul 2008 21:15:22 +0800

Originally posted by ndmmxiaomayi:

Please download this file - http://www.mediafire.com/?13diyhfhenb

As per previous instructions, save it as CFScript.txt

Drag this file into Combofix.exe. Combofix will start running and produce a log when done. Please post this log when done.

The same ol' thing, couldn't disable my antivirus but I still went ahead with running the CFScript.txt.

I couldn't upload the log to mediafire, it returned a page error.

suspected w3hph.eye malware replied by kenn3th @ Mon, 07 Jul 2008 19:00:24 +0800

kenn3th — Mon, 07 Jul 2008 19:00:24 +0800

off topic abit.

Mayi, and detached, sorry couldnt help =(

Will do so after my olevels

suspected w3hph.eye malware replied by ndmmxiaomayi @ Sun, 06 Jul 2008 20:57:33 +0800

ndmmxiaomayi — Sun, 06 Jul 2008 20:57:33 +0800

Please download this file - http://www.mediafire.com/?13diyhfhenb

As per previous instructions, save it as CFScript.txt

Drag this file into Combofix.exe. Combofix will start running and produce a log when done. Please post this log when done.

suspected w3hph.eye malware replied by Detached @ Sat, 05 Jul 2008 09:30:08 +0800

Detached — Sat, 05 Jul 2008 09:30:08 +0800

Update!

There's a RUNDLL error when I logged in to windows, it reads "Error loading C:\Windows\system32\klajxgmf.dll - the specific module cannot be found"

suspected w3hph.eye malware replied by Detached @ Sat, 05 Jul 2008 00:56:18 +0800

Detached — Sat, 05 Jul 2008 00:56:18 +0800

Originally posted by ndmmxiaomayi:

Please post back the Combofix log.

Log can be found at C:\Combofix.txt

Hmm... might not be related to any virus issue...

Sounds like an error or something.

One thing to note: The beeping only started right after I downloaded w3hph.exe, it was fine before - now it takes so long to start windows :(

http://www.mediafire.com/?vwtcebny1tm <--- Combofix log as you requested

suspected w3hph.eye malware replied by ndmmxiaomayi @ Sat, 05 Jul 2008 00:53:18 +0800

ndmmxiaomayi — Sat, 05 Jul 2008 00:53:18 +0800

Please post back the Combofix log.

Log can be found at C:\Combofix.txt

2) Whenever I log in to windows, there's always a "beep" sound (I left it out the other time)

Hmm... might not be related to any virus issue...

Sounds like an error or something.

suspected w3hph.eye malware replied by Detached @ Fri, 04 Jul 2008 21:37:06 +0800

Detached — Fri, 04 Jul 2008 21:37:06 +0800

I think my laptop's heavily infected.. Every now and then, symantec would pop up a "static" window.. or a window to tell me it had detected a virus..

The last detection was "Trojan.Vundo"... and it was "cleaned by deletion"..

Gosh.. mayi... help

suspected w3hph.eye malware replied by Detached @ Fri, 04 Jul 2008 20:44:06 +0800

Detached — Fri, 04 Jul 2008 20:44:06 +0800

Update!

1) I couldn't disable my antivirus before running combofix with CFscript but I went ahead anyway

2) Whenever I log in to windows, there's always a "beep" sound (I left it out the other time)

3) I've deleted instafinder via Add/Remove Program

4) Uploaded samples for analysis

suspected w3hph.eye malware replied by Detached @ Fri, 04 Jul 2008 17:52:19 +0800

Detached — Fri, 04 Jul 2008 17:52:19 +0800

Originally posted by ndmmxiaomayi:

Off topic, you haven't grad?

Grad'ed - I'm the 2nd batch

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:47:40 +0800

ndmmxiaomayi — Thu, 03 Jul 2008 00:47:40 +0800

OK, after uninstalling that, please do the following:

Download the following file - http://www.mediafire.com/?wlfdycs2cbg

Save it as CFScript.txt. Don't change the file name. Save it in the same place as Combofix.

Drag this file into Combofix.

Picture for reference:

Combofix will start running and produce a log. Please upload that log to Mediafire.

Also, it will ask you to upload samples for analysis.

Click OK.

Copy and paste the file path into the text box next to the Browse button (boxed up in red).

Click on Send File to upload it.

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:33:04 +0800

ndmmxiaomayi — Thu, 03 Jul 2008 00:33:04 +0800

Kazza, I did install in the past and have deleted it since months ago.

Oh...

One of the programs bundled with Kazza will hijack your home page...

Uninstall this program if found - Instafinder

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:30:29 +0800

ndmmxiaomayi — Thu, 03 Jul 2008 00:30:29 +0800

Off topic, you haven't grad?

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:29:15 +0800

ndmmxiaomayi — Thu, 03 Jul 2008 00:29:15 +0800

The Wixawin thingy - this is the 3rd time I've seen it. I can't put my fingers on anything yet. It seems to come with a lot of other crap, but no idea what's causing it.

suspected w3hph.eye malware replied by Detached @ Wed, 02 Jul 2008 20:35:54 +0800

Detached — Wed, 02 Jul 2008 20:35:54 +0800

Update...

Just couple mins ago, www.antispywareexpert.com pop up again.. This is one of the website that automatically pop up for no reason :(

Spy/Malware problem probably not fixed yet...

http://www.wixawin.com/sg/ads/iphone.aspx?clickid=000ffC00OoeO31rcdqbk&ce_cid=000ffC00OoeO31rcdq0AtGKL8Bdtvd3f <-- another malicious pop up... that tells me "win this iphone"... argh...

Recent Posts in 'suspected w3hph.eye malware' | sgForums.com

suspected w3hph.eye malware replied by Detached @ Mon, 14 Jul 2008 16:39:55 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Mon, 14 Jul 2008 16:36:08 +0800

suspected w3hph.eye malware replied by Detached @ Sat, 12 Jul 2008 15:04:25 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Sat, 12 Jul 2008 13:08:46 +0800

suspected w3hph.eye malware replied by ceecookie @ Sat, 12 Jul 2008 00:11:59 +0800

suspected w3hph.eye malware replied by Detached @ Fri, 11 Jul 2008 23:48:04 +0800

suspected w3hph.eye malware replied by Detached @ Fri, 11 Jul 2008 23:07:09 +0800

suspected w3hph.eye malware replied by Detached @ Fri, 11 Jul 2008 18:35:49 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Wed, 09 Jul 2008 22:28:32 +0800

suspected w3hph.eye malware replied by Detached @ Wed, 09 Jul 2008 21:39:07 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Wed, 09 Jul 2008 21:18:12 +0800

suspected w3hph.eye malware replied by Detached @ Wed, 09 Jul 2008 21:15:22 +0800

suspected w3hph.eye malware replied by kenn3th @ Mon, 07 Jul 2008 19:00:24 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Sun, 06 Jul 2008 20:57:33 +0800

suspected w3hph.eye malware replied by Detached @ Sat, 05 Jul 2008 09:30:08 +0800

suspected w3hph.eye malware replied by Detached @ Sat, 05 Jul 2008 00:56:18 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Sat, 05 Jul 2008 00:53:18 +0800

suspected w3hph.eye malware replied by Detached @ Fri, 04 Jul 2008 21:37:06 +0800

suspected w3hph.eye malware replied by Detached @ Fri, 04 Jul 2008 20:44:06 +0800

suspected w3hph.eye malware replied by Detached @ Fri, 04 Jul 2008 17:52:19 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:47:40 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:33:04 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:30:29 +0800

suspected w3hph.eye malware replied by ndmmxiaomayi @ Thu, 03 Jul 2008 00:29:15 +0800

suspected w3hph.eye malware replied by Detached @ Wed, 02 Jul 2008 20:35:54 +0800