Sign of a virus ?!?! Argh.

Viruses and worms
1

After doing some stuff on my laptop for a few hours, the whole screen will turn a little black and some words will appear… i ran anti virus scan on it but there is no viruses found…

The following screenshot should help -
http://i418.photobucket.com/albums/pp270/ravenoz_bucket/th_virus1232.jpg

2

Checked your screensaver settings?

3

Erm how does that help? Sorry if this sounds like a retarded question :-X

4

Well, it looks like the sort of thing that might have been installed at some point to prevent excessive time spent in front of the computer. Possibly a screensaver, maybe a program.
But quite possibly it is malicious, thought it worthwhile checking the (maybe) easy and “face value” side of things, first.

5

Lol icic. Hmms i checked the screensaver settings… seems alright to me. All the usual settings…

6
i ran anti virus scan on it but there is no viruses found..
have you tried scanning with MBAM and SAS.....
7

[font=Segoe UI]Step 1: Windows Disk Cleanup Utility ============

1 Press Windows Key + R
2 Type in: cleanmgr
3 Put a check beside: Temporary Internet Files and Temporary Files. Optionally, you may check other options too
4 Click OK

Step 2: avast! Boot Time Scan ============

1 Double click avast! antivirus desktop icon and wait for memory test to complete
2 avast GUI will appear. Right click anywhere on avast!'s window and select Schedule Boot Time Scan…
3 Click Advanced options and select Move infected file to Chest on the first dropdown list and leave the other one as it was. Click Schedule
4 You will be asked for a system restart. Click Yes to do it now or No to let avast wait for you to manually restart your PC
NOTE: Optionally, you may enable scanning of archive files. If it is enabled, scanning would be more thorough but would take more time

Step 3: Malwarebytes Antimalware (MBAM) ============

1 Download Malwarebyes’ Antimalware here
2 Proceed to installing MBAM after downloading
3 On the last dialog box, do not forget to leave Update Malwarebytes’ Antimalware and Run Malwarebytes’ Antimalware checked
4 Malwabytes’ Antimalware GUI would appear, from there select Perform Quick Scan and click Scan
5 When scan is completed, click Show Results
6 Click Remove Selected and then, a notepad file will appear.
7 On the notepad window, click File > Save As and save it on your desktop. You may now close MBAM.

Step 4: Hijack This (HJT) ============

1 Download Trend Micro Hijack This here
2 Install HJT in C:\Program Files\Trend Micro\HijackThis (the location is already displayed by default). Click Install
3 HJT Window will appear. Click Do a system scan and save a logfile. A notepad file will pop-up once the scan is completed
5 Click on the Notepad window and click File > Save As and save the file on your desktop
6 Go back here on your topic and start a reply. On the Reply window, click Additional Options
7 Attach the two .txt files that we created and saved on your desktop (click more attachments to have more slots for attaching files)
NOTE: Do not have HJT fix anything yet.

8

Tarq57 is right…that’s either a screen saver, or something installed as a reminder for a break… and if you never heard of it before, then it’s quite possibly malicious.

edit: did you open the console yourself ?

9

Now scanning with MBAM. So far no viruses found though. Whats SAS?

@L’arc: Yeah gonna run Hijackthis after MBAM…

10

all attachments… happy looking ;D . lol.

11

[font=Segoe UI]There it’s done. Report: Clean.

I could not find anything malicious in your HJT log except for deactivated entries which you may fix:

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

To fix them, open HijackThis and select Do a system scan only then put a check beside the entries above. Click Fix checked.

By the way, are you the one who opened the command prompt window at the back of the “screensaver-thing”?

12

Yup i was the one… ><. This particular virus (?) seems rather elusive…

13

i deleted the 3 selected files but it reappeared in the next scan???!

And it this next scan, the system blocked write access to the following file: notepad C:\windows\system32\drivers\etc\hosts

14

Adobe Reader 8.0 is vulnerable to attack so should be updated to Adobe Reader 9.2.

You need Administrator privilage to write to HOSTS file in Vista.

15
Now scanning with MBAM. So far no viruses found though. Whats SAS?
SAS = (SUPERAntiSpyware) http://superantispyware.com/
16

Ok updated to Adobe Reader 9.2… but the virus (?) seems to be still hiding somewhere =/

17

Have a look in your “add/remove programs” list, see if there is anything there that it could be. It could be a virus, but I think it is more likely to be a reminder, perhaps set up by your Stickies program.
Have a look at this program; I’m unfamiliar with it, but this looks like the sort of thing it might do.

Updating a program, such as Adobe, to remove a vulnerability with an old version, simply does just that. If the vulnerability had been exploited and a virus resulted, the update would not remove the virus.
Updating old/vulnerable software should be thought of as a highly recommended preventative measure, not a fix.

If you are interested in pursuing this, (it’s off this topic, but peripheral to it) check out www.secunia.org and look at the software inspectors. (Online or Installable - respectively “OSI” and “PSI”.)

18

Oh the stickies software was recently installed… so i think it should not be the cause of the problem.
Looking at secunia now ~

19
Oh the stickies software was recently installed.. so i think it should not be the cause of the problem
Maybe so. But do me a favour, have a look in the program menu/settings/history (however it works) and see if maybe there isn't some kind of scheduled "take a break" reminder. [edit] It's even possible this may be a default setting. Of course, if the message first happened before the program was installed, it must be something else.
20

Just had to interrupt. as I have had a few hassles with "Trojon-gen as per my posts, but am not getting a great deal of help and I sort of hoped that “Tarq”(I changed my name last time ) you all where a great help then hoping for a bit of the same now)
could help I just need to know what to do now that the virus is in the chest.
and do I follow thru with the Avast cleaner as well I tried to have a go but it wanted me to pay and the info seemed outdated was reading from the top of the "virus and worms posting.
Ta ???