Flickering programs due to malware?

[Mavsynchroid]

Heya. So I was in a rush to download an MKV player and without thinking clicked on the first link google gave me for a free MKV player. Of course once it installed, it started installing crap programs one after the other. I finally got it under control, and deleted all I could find. I also bought a license for malwarebytes and ran it, cleaning what I could find. Then I used AVG and SUPERantispyware to find even more crap and delete that.

 

However there's still something happening to my computer. It's kind of hard to explain but I'll give it my best shot.

 

I was playing an online game in Windowed mode called SWTOR (Star wars the old republic). I quickly realized that when I would left click rapidly, and even sometimes when I didn't, the window would flicker. By that I mean it flickers extremely fast, like a millisecond and showed the desktop behind the game window. When running programs on windows 7, there's always a little icon on the bottom of the screen, on the start up bar thingy, for the programs running. I had it so only SWTOR was running, so only the SWTOR icon was there. I noticed that sometimes when it would flicker, the icon would move over for less then a second, as if another program was starting up, only to go back to it's original spot, as if the program starting up cancelled itself.

 

I also notice this when web browsing. This is a bit more specific so bare with me. Say I have two separate windows open, each one having a web page on it. One is maximized to full screen. The other is not full screen, lets say taking up half the space of the screen. Now lets say I minimize both of them. When I try to bring up the full screen web browser window, it'll pop up, but the smaller window will pop up infront of it as well, as if I brought that one up after the full screen one, even though I didn't.

 

I personally think some sort of program, be it malware, a virus, etc, is quickly starting up only to disappear everytime I see that flicker. However when scanning with those three programs I mentioned above, the only thing that keeps popping up now is in SUPERAntiSpyware, and the threat is called...

 

"Trojan.Agent/Gen-Patched" and the directory is "C:\PROGRAM FILES\iu??o??-\1???a?e?ONLINE\TCLS\TE...\MEMORYALLOCTOR.DLL"

 

The letters i, u, o, a, and e in that directory are, I guess I'd say, the Spanish(?) version of those letters. They all have little accents above them.

 

Anyway, it should have been deleted after the first scan and reboot, but it's still there.

 

Also, even just while typing this, the web browser window flickered again.

 

I'm sorry I can't be more specific, but it's incredibly hard to explain. I don't know if that MEMORYALLOCTOR.DLL is the one causing the problems or not, but I feel like this is something I can't ignore.

 

If anyone can help me at all, I would greatly appreciate it! Thank you in advance!!

 

[kevinf80]

Hello and welcome to Malwarebytes,

Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

 

Please open Malwarebytes Anti-Malware.

• On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
• Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
• Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
• A Threat Scan will begin.
• With some infections, you may or may not see this message box.
  
          'Could not load DDA driver'
• Click 'Yes' to this message, to allow the driver to load after a restart.
• Allow the computer to restart. Continue with the rest of these instructions.
• When the scan is complete, click Apply Actions.
• Wait for the prompt to restart the computer to appear, then click on Yes.
• After the restart once you are back at your desktop, open MBAM once more.
  

To get the log from Malwarebytes do the following:

• Click on the History tab > Application Logs.
• Double click on the scan log which shows the Date and time of the scan just performed.
• Click Export > From export you have three options:
  
    Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
    Text file (*.txt)        - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
    XML file (*.xml)      - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
• Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…
  

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

• Double-click mbam-setup and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to the following:
• Launch Malwarebytes Anti-Malware
• A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
• Click Finish. Follow the instructions above....
  

Next,
 
Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either, accept the alert or turn your security off to allow FRST to run. It is not malicious or infected in any way...

• Double-click to run it. When the tool opens click Yes to disclaimer.
  (Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
• Make sure Addition.txt is checkmarked under "Optional scans"
• Press Scan button to run the tool....
• It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
• The tool will also make a log named (Addition.txt)  Please attach those logs to your reply.
  

Let me see those logs in your reply...

 

Thank you,

 

Kevin
 

[Mavsynchroid]

EDIT: (Sorry I don't see an edit button anywhere for my original post)

 

I happened to look in the log of the Superantispyware scan, so I found the original directory that supposed trojan is in. It is as follows.

 

"C:\PROGRAM FILES\ìú??ó??·\1???á?è?ONLINE\TCLS\TENIO\MEMORYALLOCTOR.DLL"

[kevinf80]

Can you post the logs i`ve asked for....

[Mavsynchroid]

Thanks anyway. I've downloaded stuff in the past that could be considered suspect, so I probably won't get any help here if there are remnants on my PC. Would rather save you the time.

[kevinf80]

I`ve already offered my help, if you feel it is no longer required we can just close out, is that what you want....

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.