bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

Reply

Join Date: Aug 2008
Posts: 19
Reputation: matty sal19 is an unknown quantity at this point 
Solved Threads: 0
matty sal19 matty sal19 is offline Offline
Newbie Poster

bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #1
Jul 26th, 2009
hi,
about 2 days ago after installing a video codec called alfa BR i started to get bluescreen errors with the code 0x0000007F(0x00000008,0x803D3130,0x00000000,0x00000000). i also started getting error messages from windows defender saying i had a virus called TrojanDownloader:Win32/Renos.IO. i have tried to run mbam but my pc wont let me run it.
here is my hjt log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:11:55, on 26/07/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18248)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Users\matty\AppData\Local\Temp\RarSFX0\RegCure.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\SiS VGA Utilities\SiSTray.exe
C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\The TechGuys\Launch\Launch.exe
C:\Users\matty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I4JOOTR5\80twfi7d[1].exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\matty\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SUQV910F\RSIT[1].exe
C:\Program Files\trend micro\matty.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/...arch.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SiSTray] %ProgramFiles%\SiS VGA Utilities\SiSTray.exe
O4 - HKLM\..\Run: [UpdateP2GShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\5.0"
O4 - HKLM\..\Run: [Wireless Manager] "C:\Program Files\Virgin Broadband Wireless\Wireless Manager.exe" startup
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Launch.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbar...p=ZRxdm821YYGB
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - (no file)
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.regcure.com
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...tup1.0.1.1.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{130B1BB3-9333-446A-AAD8-B162A9A5056B}: NameServer = 85.255.112.210,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\..\{1533290B-BB13-4AE0-BC5B-C23E1C8AC21E}: NameServer = 85.255.112.210,85.255.112.65
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.210,85.255.112.65
O17 - HKLM\System\CS1\Services\Tcpip\..\{130B1BB3-9333-446A-AAD8-B162A9A5056B}: NameServer = 85.255.112.210,85.255.112.65
O17 - HKLM\System\CS6\Services\Tcpip\Parameters: NameServer = 85.255.112.210,85.255.112.65
O17 - HKLM\System\CS6\Services\Tcpip\..\{130B1BB3-9333-446A-AAD8-B162A9A5056B}: NameServer = 85.255.112.210,85.255.112.65
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.210,85.255.112.65
O23 - Service: AffinegyService - Affinegy, Inc. - C:\Program Files\Virgin Broadband Wireless\AffinegyService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe

--
End of file - 10497 bytes
Reply With Quote Quick reply to this message  
Join Date: May 2009
Posts: 908
Reputation: Rik from RCE is on a distinguished road 
Solved Threads: 68
Rik from RCE's Avatar
Rik from RCE Rik from RCE is offline Offline
Posting Shark

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #2
Jul 26th, 2009
Your pc is quite badly infected. Could you do a full scan with Mbam and post it's results.
Reply With Quote Quick reply to this message  
Join Date: Aug 2008
Posts: 19
Reputation: matty sal19 is an unknown quantity at this point 
Solved Threads: 0
matty sal19 matty sal19 is offline Offline
Newbie Poster

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #3
Jul 26th, 2009
I've tried to run mbam it installs fine but when I run it it says it has stopped working and won't let me open it. My norton 360 has been disabled aswell and when I try to turn it on I get the blue screen.
Reply With Quote Quick reply to this message  
Join Date: May 2009
Posts: 908
Reputation: Rik from RCE is on a distinguished road 
Solved Threads: 68
Rik from RCE's Avatar
Rik from RCE Rik from RCE is offline Offline
Posting Shark

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #4
Jul 26th, 2009
Seeing as that Norton rubbish is disabled anyhow, see if you can uninstall it.
I can suggest free replacement software that will do a far far better job than Norton isn't doing.

Let me know if Mbam will or won't run once Norton is gone.
Reply With Quote Quick reply to this message  
Join Date: Aug 2008
Posts: 19
Reputation: matty sal19 is an unknown quantity at this point 
Solved Threads: 0
matty sal19 matty sal19 is offline Offline
Newbie Poster

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #5
Jul 26th, 2009
Ok I've uninstalled norton and mbam still won't run. When I restarted my pc the Internet won't work but any programs you recommend I can get on my other pc and install them
Reply With Quote Quick reply to this message  
Join Date: Aug 2008
Posts: 19
Reputation: matty sal19 is an unknown quantity at this point 
Solved Threads: 0
matty sal19 matty sal19 is offline Offline
Newbie Poster

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #6
Jul 27th, 2009
I may have been a bit unclear in my last post. What I Meant was I can use the Internet on my parents pc and when I find the program I can save the .exe file to my memory stick and run it on my laptop.
Reply With Quote Quick reply to this message  
Join Date: May 2009
Posts: 908
Reputation: Rik from RCE is on a distinguished road 
Solved Threads: 68
Rik from RCE's Avatar
Rik from RCE Rik from RCE is offline Offline
Posting Shark

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #7
Jul 27th, 2009
Download Combofix from HERE

Warning, extreme caution should be observed with combofix.

It will take control of your pc, do not even touch your mouse and keyboard until combofix has finished.

It will restart your pc and then produce a log, post that log in your next reply.
Reply With Quote Quick reply to this message  
Join Date: Aug 2008
Posts: 19
Reputation: matty sal19 is an unknown quantity at this point 
Solved Threads: 0
matty sal19 matty sal19 is offline Offline
Newbie Poster

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #8
Jul 27th, 2009
i tried to run combofix but it gave me a message saying combofix has stopped working. just like it does with mbam.
Reply With Quote Quick reply to this message  
Join Date: May 2009
Posts: 908
Reputation: Rik from RCE is on a distinguished road 
Solved Threads: 68
Rik from RCE's Avatar
Rik from RCE Rik from RCE is offline Offline
Posting Shark

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #9
Jul 27th, 2009
Go HERE with your laptop and attempt an online virus scan. Let me know how it goes.
Reply With Quote Quick reply to this message  
Join Date: Aug 2008
Posts: 19
Reputation: matty sal19 is an unknown quantity at this point 
Solved Threads: 0
matty sal19 matty sal19 is offline Offline
Newbie Poster

Re: bluescreen errors and TrojanDownloader:Win32/Renos.IO virus

 
0
  #10
Jul 27th, 2009
my laptop can't connect to the Internet because of the virus. I think I might have to take it to a technician unless there is another way.
Reply With Quote Quick reply to this message  
Reply

This thread is more than three months old.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the Viruses, Spyware and other Nasties Forum
Thread Tools Search this Thread



Tag cloud for Viruses, Spyware and other Nasties
About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC