Is It Malware/Adware Help Appreciated

[Guest]

[UncleDoug]

I have really not found an answer to my question. When reading many will say it is adware or malware but I have found no other solutions are files that are missing and how to reinstall them.

There are 2 problems almost similar.  They do not happen every time or on a particular site.

Problem 1,   When nothing is open some times windows just start popping open fast and furious.  I found hitting the escape key will slow them or stop them and I can manually close each window

Problem 2   When reading a page it will drop to the end.  as I said this can happen any where and twice when I was looking at Comodo Forum Index and the title of the forum I found myself looking at who was logged in to the Comodo Forum.  My hand was not on the mouse.

This might be a mouse problem?  Reinstalled drivers  (basic wired mouse  uninstalled a logitech wireless mouse 2 years ago using Revo.  
The desktop with multiple windows popping open could be the mouse just passing over a link (but I slowed the click down to open)

I have run Emissoft A2squared, Malwarebytes, and SuperAntiSpyware in both normal and safe mode.  Nothing noticeable was found.  Emissoft and Malwarebytes found trojans in F drive snapshot for restore files and SuperAntispyware  found cookies on C.
CCE found a few items on F autorun analyzer found nothing.  

F drive was the original drive from 4 years ago and should not have an affect on these problems.

Attached are 2 logs  Hitman Pro  and HiJack This

Doubt you will find anything noticeable but hope you might have a few suggestions for my problem besides reinstalling  

Thanks for your Help
UncleDoug
 

[Chiron]

To make sure malware is not present please follow the steps in How to Know If Your Computer Is Infected and let us know what the results are.

Thanks.

[UncleDoug]

Sorry for the delay

TDsskiller scan was clean

CCE Smart Scan was clean

Killswitch scan was clean

Autoruns scan was questionable

First I use an old D-Link wireless adapter.  In the taskbar I want to see the MS montor showing the internet connection and also the vertical Green bars showing the D-link connection. 
The first image was only showing the MS monitor connection yesterday.
Today when I started up there was no internet connection (not uncommon) so I right clicked on the D-Link link. before running CCE, Killswithc, and Autoruns.
The first scan today gave image 2, about 7-8 minutes later I reran Autoruns and the new image was identical to autorun1.

I believe these to be false positives and suprised that Creative labs has not been previously analyzed ?  Not sure about the Tcpip but think this could have been a false positive.  Will be trying to send them after this post.  Hope Comodo could simplify reporting to multiple sights from within the scan itself.

As I first said I doubt malware is causing my problem of multiple windows popping open on the desktop or a page or screen jumping from the top to the bottom. but the only suggestion I most read is the "possibility" of malware.

Thank you for helping
UncleDoug

[UncleDoug]

Here are the results


Comodo Antivirus Lab info[at]avlab.comodo.com
1:28 PM (54 minutes ago)

to me
Hi,

The following samples you submitted as false positives are not detected by Comodo Internet Security version 5.10.228257.2253with Antivirus database version 12904:

ousb2hub.sys    (SHA1:fd2df8f7e1440c2c915a95af9af9ac5a12bebc30)
ousbehci.sys    (SHA1:95248350129fe13b9230ef30ba17ac9de50e5889)
TCPIP.SYS    (SHA1:5b2f8c2b1409a81cfeaa8112e9817eaac4b2494e)
CTOozicFt.dll    (SHA1:14fc6af16f95bcdc03f50d2256a7acb7f7f1dfbe)
CTMp3SFt.dll    (SHA1:bba2effcfa84adc0bc16056335f74272044b375e)
CTWmSFlt.dll    (SHA1:f8f36894ec7203932ca19d0c103b1ee5039da81a)
AudioHQU.exe    (SHA1:c491762ec1ff462be562ebbd079905057c6c4cc5)
CTMDCen.crl    (SHA1:0b5188f9bf4512eeb9ef297733833206e1af17cc)
CTMDCen.exe    (SHA1:44e2bf966cca74fe964274583a239d69752ace8a)
CTNotify.exe    (SHA1:90ae1bcdd20726b72e18fe0569d5a9b8cd5e2a21)
CTRec.exe    (SHA1:aeb23058f26047aa98dfc6f3ea55f12f6a6f4343)

[Chiron]

Here are the results


Comodo Antivirus Lab info[at]avlab.comodo.com
1:28 PM (54 minutes ago)

to me
Hi,

The following samples you submitted as false positives are not detected by Comodo Internet Security version 5.10.228257.2253with Antivirus database version 12904:

ousb2hub.sys    (SHA1:fd2df8f7e1440c2c915a95af9af9ac5a12bebc30)
ousbehci.sys    (SHA1:95248350129fe13b9230ef30ba17ac9de50e5889)
TCPIP.SYS    (SHA1:5b2f8c2b1409a81cfeaa8112e9817eaac4b2494e)
CTOozicFt.dll    (SHA1:14fc6af16f95bcdc03f50d2256a7acb7f7f1dfbe)
CTMp3SFt.dll    (SHA1:bba2effcfa84adc0bc16056335f74272044b375e)
CTWmSFlt.dll    (SHA1:f8f36894ec7203932ca19d0c103b1ee5039da81a)
AudioHQU.exe    (SHA1:c491762ec1ff462be562ebbd079905057c6c4cc5)
CTMDCen.crl    (SHA1:0b5188f9bf4512eeb9ef297733833206e1af17cc)
CTMDCen.exe    (SHA1:44e2bf966cca74fe964274583a239d69752ace8a)
CTNotify.exe    (SHA1:90ae1bcdd20726b72e18fe0569d5a9b8cd5e2a21)
CTRec.exe    (SHA1:aeb23058f26047aa98dfc6f3ea55f12f6a6f4343)

Actually, those were not flagged as dangerous but merely as unknown. This just means that Comodo hasn't added them to its whitelist yet. To get these added please follow the advice in this post. Doing so now may help you in the future.

As to what your problem may be, I'm not sure. I'll ask around.

[jay2007tech]

Just a possible idea lsp-fix
http://www.cexx.org/lspfix.htm

LSP-Fix repairs the LSP chain by removing the entries left behind when LSP software is removed by hand (or when errors in the software itself break the LSP chain), and removing any gaps in the chain.

LSP-Fix is not a malware removal utility and does not target specific products. LSP-Fix does not delete any files.

Even though it doesn't delete any files, Create a system restore point first. 

[UncleDoug]

Thank You for your suggestion, but over all I do not have problems getting on the internet.  Possible you might have a suggestion as to a fix !

Sometimes on the desktop I lose sight of the cursor and multiple windows, just start opening and I have no control until I close every thing,  Also I could be reading a page any page (the Comodo Forums Index as an example) and the page will jump from the line I am reading at the top to the end of the page without me touching any thing.

Thank you for your suggestions and help,
UncleDoug

[Tags:]