Trojan through streaming videos [Resolved]

Hello, I’ve had problems with my computer for quite some time now, and I’m hoping that you will be able to solve atleast some of it.

So, here’s the story:

I was watching videos from warcraftmovies.com, a few minutes after starting my third movie(approx 15-20 min) I hear the computer starting to make a LOT of noise. Usually it only does that when I have like winamp, World of warcraft, ventrilo and MSN up together, so I became suspicious. I chose to reboot, and when I had the window of “Your computer has been restored after a system error” (or something close to that) pop up directly at the start it freaked me out.

I scanned 3-5 times a week with Avira, couldn’t find anything.
After 1 week I get hacked on WOW, my mail, and my Steam account.
I start up avira, ran a full search, then ran every specific searches 1 by 1 right after.
No threats, no discoveries, nothing.

So I think “Yeah well, then it must have come from an outside computer”, so I block all access from all other computers.

1½ week after that, when i’ve had my items restored on wow, and I log in, the computer shuts down 10 seconds after typing in my information.

Reboot, new searches, still found nothing.

I get mad, decide to format my harddrive.
After that I uninstalled Avira, Installed AVG, and Comodo firewall.

When I have just installed wow and steam again, Comodo starts finding alot on the System Protection Events.

One of those is C:\WINDOWS\system32\mshta.exe trying to install hooks (my knowledge about the windows processes is very limited). and C:\WINDOWS\system32\services.exe trying to modify keys.

What Im looking for here is: After re-installing all of windows XP, downloading the new .exe files from another computer (using full norton 2009, scanned every day) virusfree computer and installing, can I still be infected?

Only flaw I did (i think) was that I let the internet cable stay in during the formating and windows-installing.

Help anyone?

Attached last HijackThis scan

[attachment deleted by admin]

Dear Reventor,

your hijackthis file seems safe. But could you do a scan with A-squared please ?
download here : http://download.cnet.com/3001-20_4-10262215.html?spi=f1728bf3cb03cf807e18b7664190fc64

Please post back the results afterwards.

yours sincerely,
Xan

1 other thing.
It seems that you’re using AVG together with Comodo. Do you have Comodo’s AV disabled and AVG’s firewall ? Please do so, as they might clash with each other…

Xan

Going to use A-squared.

Yes, I have AVG antivirus,Comodo safesurf and firewall.

I chose not to install AVG’s firewall since I know they would clash, and 2 firewalls doesnt raise security level.

new post coming when i’ve scanned a-square.

Ok, complete scan completed. Updated first ofc.

Results are attached.

[attachment deleted by admin]

Are you running multiple on-access malware scanners?
Does an MBam scan show anything?
Any chance you blocked an event that needs to run? Try placing Defense+ in Training mode.

Services.exe always gets flagged when it does stuff. You were installing WOW and Steam. Steam runs as a service so it is normal services.exe would flag it and ask for permission to modify keys…

Even though you had the internet cable attached you still would have Windows Firewall running with XP SP 2 and up. Windows Firewall does a good job keeping bad guys out so I don’think that compromised you.

You tried several scanners already and posted a clean Hijack This log. I would suggest to let Super Antispyware run. When all these scanner don’t show up anything I think your system is clean.

Ok, I’ll try Super Antispyware and add a log to this thread again once done.

Atm scanning with all my programs again (Asquared, Hijackthis and AVG full slow scan)

Never thought I would get help like this so easily. Everyone at Comodo should be proud of having a service like this, since there are not many that have these high standards.

Thank you a million!

There, finished with all my scans.

If anyone could just eye through these logs and leave a comment, I’d appreciate it alot!

Thanks for everything!
Reventor

[attachment deleted by admin]

Dear Reventor,

your computer seems safe to me :slight_smile:

Xan

Yay, After 2 weeks of WOW-abstinence, after reading that I’m finally confident enough to log in and start playing on my own computer again.

You may close the thread now if desired, and remember that you made a 18 year old game-nerd very happy today!

Reventor

well the this 17 year old standard user will lock the topic ;D

%lock%

Xan