Win32:PurityScan-AF virus??  I need help once again

system · 2007-07-02T21:02:06.000Z

Logfile of HijackThis v1.99.1
Scan saved at 4:00, on 2007-07-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Airlink101\AWLC4030\WLService.exe
C:\Program Files\Airlink101\AWLC4030\WLanCfgAG.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\Hijackthis\HijackThis.exe

system · 2007-07-02T21:02:58.000Z

system · 2007-07-02T23:17:56.000Z

Open HJT again and click Do a System Scan Only. Place a check next to these lines and, after closing all other windows (including your browser) click Fix Checked

[b]O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420C6B61F1} - C:\WINDOWS\system32\mtgafqjo.dll (file missing)

O2 - BHO: (no name) - {81DD6C8F-EA28-4CFF-A56A-5BD9A8F1D1FD} - (no file)[/b]

I need a little information from you now. How is the computer running? Have the trojan alerts ended?

system · 2007-07-03T00:51:14.000Z

I’ve done the fixed checked, what should I do now?

The computer is running a lot better, I haven’t had a trojan alert in the past few days. The only problem I am having is the screen going green on me and the lines cutting across and filling the page. I hadn’t had the problem til these recent trojans so I didn’t know if there’s a correlation. Everything else seems to be running fine. I did notice that my screen saver does not go on anymore like it used and I haven’t made any changes.

system · 2007-07-03T01:04:39.000Z

I’m still a bit concerned about this file

C:\Program Files\Messenger\meqot43855.dll

See if you can rename it from meqot43855.dll to meqot43855.old

Then upload the renamed file to Virus Total. If this works post the results of the scan.

With the green lines the only thing I can think of, other than a hardware problem, is if the video driver became corrupted. If you tell me the make and exact model of your computer (and video card if you have one) I’ll see if I can find a driver to download. I will tell you, too, that I downloaded a driver update on my laptop a couple days ago that completely messed things. Have there been any video updates recently on yours?

If you right click your screen and click Properties can you reset your screen saver from there?

system · 2007-07-03T01:33:06.000Z

I’m having finding the file.
I have done a search for it but it says file cannot be found. I did find the folder Messenger but it did not have meqot43855.

Lisandro · 2007-07-03T01:53:55.000Z

brenda31 post:114:

The only problem I am having is the screen going green on me and the lines cutting across and filling the page.

Can you post a screenshot?
To know how to post a screenshot, see http://forum.avast.com/index.php?topic=8982.0
You can use Gadwin PrintScreen to get a screenshot (http://www.gadwin.com/printscreen/) or the free version of WinSnap 1.1.10 (http://www.filehippo.com/download_winsnap/?2173).

system · 2007-07-03T02:03:15.000Z

In addition to the screen shot, click Start>My Computer>Tools (at the top of the window that opened)>Folder Options>View Tab.

Make sure Show Hidden Files and Folders is checked and Hide Protected Operating System Files is not checked.

Now double click C:> double click Program Files> double click Messenger.

Is the file present now?

system · 2007-07-03T02:09:16.000Z

It is not there. I only have msglangs.dll, msgsc.dll, custstat.dll

system · 2007-07-03T02:30:57.000Z

OK 8)

Uninstall 7 Zip to get those extraneous files off your desktop.

If you want to reinstall this program again (it is handy) make sure to use the default installation path.

Next, open OTMoveIt and click the CleanUp! button You may get prompted by your firewall that OTMoveIt wants to contact the internet, allow this, a cleanup.txt will be downloaded, and a message dialog will ask you if you want to proceed with the cleanup process. Click Yes. This will delete all the tools you have downloaded plus itself

Now the step that you may have overlooked in your earlier thread but is important:

Click Start>All Programs>Accessories > System tools > System Restore
In the dialog box that appears Click in the radio button to Create a Restore Point
Click NEXT
Enter a name you will remember if you need to find this again (like Clean Point)
Click CREATE

You now have a clean restore point, to get rid of the old ones:

Click Start>All Programs>Accessories > System tools > Disk Clean Up
Click OK on the C: drive
Click the More Options tab
In the System Restore section click the Clean Up button

Now download ATF Cleaner by Atribune to your desktop, Double click ATF-Cleaner.exe to run the program. Put a check mark in all the options except Prefetch and click Empty Selected. If you use Firefox or Opera click those tabs and clean those too (you might want to leave Saved Passwords unchecked).

Then the screen shot of the video problems Tech asked for would be helpful.

EDIT:

brenda31 post:114:

I did notice that my screen saver does not go on anymore like it used and I haven’t made any changes.

If you downloaded a free screen saver from an internet site it may have been deleted during our cleaning process. Those sites are often the source of adware and trojans and are best avoided.

Lisandro · 2007-07-03T02:39:14.000Z

And the screenshot?

system · 2007-07-03T03:01:22.000Z

Sorry, I totally missed the part about the screenshot. Let me see if I can do that.

system · 2007-07-03T03:13:15.000Z

Here is the snapshot.

Lisandro · 2007-07-03T03:19:56.000Z

brenda31 post:114:

The only problem I am having is the screen going green on me and the lines cutting across and filling the page.

Where are the lines? ???

system · 2007-07-03T03:35:30.000Z

Well the lines come and go and go and they’ll fill up the whole screen. When this happens then I can’t move my mouse. It seems like it’ll get frozen for a second with a line cutting horizontally across the screen and if I move the screen, then it’ll unfreeze and the horizontal line will move either up or down. Then the whole screen goes green/pink with lines going from top to bottom. It hasn’t happened in a little while. If I’m able to I will post a pic if it happens again.

system · 2007-07-03T03:50:40.000Z

Does it look like these

http://discussions.virtualdr.com/showthread.php?t=176454

Its amazing how many hits you get if you google “green and pink screen lines”.

system · 2007-07-03T03:54:11.000Z

Actually the lines are thinner and don’t really spaces in between.

system · 2007-07-03T04:00:31.000Z

Many of the google hits are related to ATI Radeon video cards. I know you have ATI video drivers (from your logs) but I can’t tell if your graphics are intergrated or you have a card installed.

Do you know if you have a video card and, if there is, how old it is?

EDIT: Appearently ATI GForce cards are also affected to some degree.

EDIT #2: Heres a link to the ATI support site reagrding display corruption, including lines, checkerboard patterns, flashing dots, giant triangles, etc

http://support.ati.com/ics/support/default.asp?deptID=894&task=knowledge&questionID=28026

I’m wondering how a giant triangle actually fits on the screen.

system · 2007-07-04T18:07:07.000Z

How can I check to see if i have a video card installed?

Lisandro · 2007-07-06T01:40:59.000Z

brenda31 post:129:

How can I check to see if i have a video card installed?

Right click the desktop, choose Properties and then Configurations.
If it is not clear there, choose Advanced and Adapter tab of settings.

Announcements