Computer acting strange - could you look at Hijack This log?
Hi.
So, just a few days after I got rid of the TDSS virus, my computer started acting very strange. Upon reboot, it would not load AVG Free or Zone Alarm, and iTunes would not start when I plugged in my iPhone. I was able to solve those issues. In Zone Alarm, I went in and re-checked the box that says to launch it on startup. For AVG, I ran the repair installation from the install file. For iTunes, I reinstalled it.
However, I am still having one issue that I cannot solve. A program called dotmacsyncclient.exe gives me the following error at random times:
The application failed to initialize properly (0xC0000142). Click on OK to terminate the application.
When I click OK, my computer does not respond for an indeterminate amount of time. I can't slick on 'Start', and even Ctrl-Alt-Del does nothing. After a while, my computer will finally respond again, but my internet connection is dead, and I have to reboot to get it working again.
I have run SUPERAntiSpyware in Safe Mode, and Malware Bytes in normal mode, but neither found anything. I've attached my Hijack This log. Could you look at it for me and let me know if you notice anything weird?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:22:58 AM, on 1/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Download gmer.zip: http://www.gmer.net/files.php
Unzip the file, and double click on gmer.exe, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.
GMER log is clean. dotmacsyncclient.exe seems to belong to some iPhone, or other Apple mobile device sync program. It should be located in: C:\\Program Files\Common Files\Apple\Mobile Device Support\bin
I don't know what device you use, but most likely, you should reinstall application, which came with it.
Now, let's take a look at your HJT log.
Malware-wise, the log is clean.
I can see, this service running:
-O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
which most likely calls for dotmacsyncclient.exe file
The above service also runs this startup:
- O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
You also have couple of unneeded startups, which can be safely disabled. No actual programs will be removed.
Open HJT, and checkmark:
- O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
- O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
- O4 - HKCU\..\Run: [QuickGammaLoader] C:\Program Files\QuickGamma\QuickGammaLoader.exe (unless you work as a graphic designer)
- O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (same as the above)
- O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
Click "Fix checked" button.
Restart computer.
- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK
3. Restart computer.
4. Turn System Restore on.
5. Make sure, Windows Updates are current.
6. If any Trojan was listed among your infection(s), make sure, you change all of your important passwords (bank account(s), secured web sites, etc.) immediately!
7. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
Reply With Quote
