TechSpot

[Resolved] Double click virus

By taniagisell
Mar 27, 2010
Topic Status:
Not open for further replies.
  1. So I've had the doubleclick.net adware for a while now. I've done multiple antivirus scans and it never caught it, I used super anti virus and anti-malware a while ago and it caught something I deleted it and but it came back worse. Everything I clicked was a double click, and things closed on me constantly. Right now I did the eight step process including the two cleanings and I think it is gone now. I am posting my logs just in case you guys spot something wrong.
     

    Attached Files:

  2. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    I think you're referring to the Tracking Cookies:

    To prevent:
    Internet Explorer: Tools or Control Panel> Internet Options> Security tab> Restricted Sites> Sites> type each of the following in and click on Add after each:

    *.doubleclick.net
    *.doubleclick.com


    Then click on Apply> OK

    For Firefox: Tools> Privacy> Cookies> Exceptions: type each of the following, then Block after each:
    *.doubleclick.net
    *.doubleclick.com


    Be sure to use the * as it is a Wild Card.

    Better also, reset Cookies in both:

    For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> CHECK 'override automatic Cookie handling'> CHECK 'accept first party Cookies'> CHECK 'Block third party Cookies'> CHECK 'allow per session Cookies'> Apply> OK.

    For Firefox: Tools> Options> Privacy> Cookies> CHECK ‘accept Cookies from Sites’> UNCHECK 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')

    I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
    AdBlock Plus
    Easy List

    Congratulations! Your logs are clean. And now you have the tracking Cookies under control.
     
  3. taniagisell

    taniagisell TS Rookie Topic Starter

    Thank you so much, I have done everything you suggested.
     
  4. taniagisell

    taniagisell TS Rookie Topic Starter

    So, the problem returned as soon as I put my SD card in when I began to choose pictures from my camera on it my clicks became double clicks again. Is it possible that the cookies are in the SD card now? I had put it in while the problem was going on a few days ago, or is this a problem with the mouse?
    Should I run the cleaner again, while the SD card is in?
    Double clicking is not happening online, it isn't happening when I am using firefox, only on my desktop mainly on Adobe Photoshop.
     
  5. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Okay, it's obvious we're talking about 2 different things! "doubleclick.net" is the name of a Domain. I guess they thought it was clever because most people have a 'double click' set to open files. Here are some other ones:
    Common Tracking Cookies:
    .112.2o7.net
    .2o7.net
    .ad.yieldmanager.com
    .ad.yieldmanager.com
    .adrevolver.com
    .ads.pointroll.com
    .advertising.com
    .atdmt.com
    .bluestreak.com
    .as.casalemedia.com
    .doubleclick.net
    .fastclick.net
    .mediaplex.com
    .realmedia.com
    .statcounter.com
    .trafficmp.com
    .tribalfusion.com

    These are usually embedded in a banner or ad on a site. And if 3rd party Cookies are allowed, you can get another one any time the site you're on has the Cookie embedded. But it's not a virus, it's not even spyware- although some, like myself, don't want anything tracking me!

    The # of clicks to open is set in Folder Options:

    Control Panel (or Tools)> Folder Options> General tab> Click items as follows> Choose :
    • Single click to open (point to Select)
      OR
    • Double click to open (single click to Select)

      Then Click on Apply> OK

      As for the mouse itself, the # of clicks is set in Folder Options, but the buttons to use for those clicks are set in Control Panel> Mouse> Buttons tab.

      What I told you are restricting the domains was correct. Resetting the Cookies was correct.

      Why are you thinking this is some kind of virus? Did this start happening all of a sudden? Had you done anything before like update, download, etc. Maybe the SD card can't read the single click. I don't have any problem with that.

      But if you mean something else specifically other than what I've given you, you're going to have to clarify it for me. Just to be sure I did a search for 'doubleclick virus' and was amazed at how many users are asking about it!

      Read Chris' description of Tracking Cookie here: http://chris.pirillo.com/what-is-a-tracking-cookie/
     
  6. taniagisell

    taniagisell TS Rookie Topic Starter

    Yes, it did start suddenly out of nowhere. I don't remember downloading anything large besides Manycam, I don't use p2p shareware. The only thing I download are word files off my professor's blackboard pages.
    I call it a virus because it is not only happening when I am browsing it happens on my desktop, when I'm looking through my files and when I am using programs like paint or photoshop. I will click on something and it will open, I will try to select multiple images by selecting them and using CTR but It will double click the first time and i have to select images one by one. I will try to drag a layer and the whole program will close down for reason's unknown.
     
  7. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    A file doesn't have to be large to have adware with it. When did you download Manycam? did you have the problem before- or did it start after?

    I need you to get away from the 'double click' terminology for a bit:

    There's always a reason- you just don't know what it is yet. Right after this crashes, I'd like you to do this:

    Please download VEW and save it to your Desktop:

    Setting up the program

    Double-click VEW.exe then under Select log to query, select:
    • Application
      [*] System



      Under Select type to list, select:
    • Critical (Vista only)
    • Error

      Click the radio button for Number of events
    • Type 20 in the 1 to 20 box
    • Then click the Run button.
    • Notepad will open with the output log.

      Load the log
    • In Notepad, click Edit> Select all
    • Then press Edit > Copy
    • Press Ctrl+V on your keyboard to paste the log to your next reply.

    (Courtesy rev-Olie)

    I'll look over the Events. If I can spot something, I'll try to help. If not, I'll refer you to the Windows OS forum.
     
  8. taniagisell

    taniagisell TS Rookie Topic Starter

    Vino's Event Viewer v01c run on Windows XP in English
    Report run at 28/03/2010 8:24:06 PM

    Note: All dates below are in the format dd/mm/yyyy

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    'Application' Log - error Type
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Log: 'Application' Date/Time: 24/03/2010 6:54:34 PM
    Type: error Category: 0
    Event: 1000 Source: Application Error
    Faulting application firefox.exe, version 1.9.1.3685, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0001b21a.

    Log: 'Application' Date/Time: 20/03/2010 12:25:00 AM
    Type: error Category: 50
    Event: 4609 Source: EventSystem
    The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    'System' Log - error Type
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Log: 'System' Date/Time: 28/03/2010 1:28:17 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 27/03/2010 1:54:49 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 27/03/2010 1:46:21 AM
    Type: error Category: 0
    Event: 7000 Source: Service Control Manager
    The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

    Log: 'System' Date/Time: 27/03/2010 1:46:05 AM
    Type: error Category: 0
    Event: 7000 Source: Service Control Manager
    The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

    Log: 'System' Date/Time: 21/03/2010 9:00:16 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 20/03/2010 12:23:49 AM
    Type: error Category: 0
    Event: 7031 Source: Service Control Manager
    The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

    Log: 'System' Date/Time: 20/03/2010 12:23:41 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The DNS Client service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:23:05 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:22:55 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The Kodak AiO Network Discovery Service service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:22:39 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The iPodService service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:22:33 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 19/03/2010 9:11:12 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 16/03/2010 2:43:44 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 13/03/2010 8:13:14 AM
    Type: error Category: 0
    Event: 29 Source: W32Time
    The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

    Log: 'System' Date/Time: 13/03/2010 8:13:14 AM
    Type: error Category: 0
    Event: 17 Source: W32Time
    Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Log: 'System' Date/Time: 13/03/2010 8:13:06 AM
    Type: error Category: 0
    Event: 29 Source: W32Time
    The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

    Log: 'System' Date/Time: 13/03/2010 8:13:06 AM
    Type: error Category: 0
    Event: 17 Source: W32Time
    Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Log: 'System' Date/Time: 06/03/2010 12:25:55 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 20/02/2010 5:10:48 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 11/02/2010 9:09:35 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {6A972E27-93E2-4F98-8367-4101B2073814} did not register with DCOM within the required timeout.
     
  9. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    Give this a try please:

    Right click on the Clock in the Notificarion Area, right bottom> click on 'Adjust Date/Time':
    1. Date/Time tab: be sure the correct date and time are set>
    2. Time Zone tab> Make sure the correct Time Zone is set for your location> Check 'Automatically adjust time for Daylight Time'>
    3. Internet Time tab> Check 'Automatically Synchronize time with the internet time server'> copy the time server below:
      tick.usno.navy.mil
      Paste this time server in the dialog box
    4. Click on 'Update Time'> after the time correction click on Apply> OK
    ==================================
    The DCOM problems can have several different causes: Please make sure the following Services running on your machine as indicated: To access the Services:

    Click on Start> Run> type in services.msc> double click on the Service to open:
    1. - Com+ Event System> Manual Startup type (needed by SENS Service)
      [*]- Com+ System Application> Manual Startup type
      [*]- DCOM Server Process Launcher> Automatic Startup type
      [*]- Distributed Transaction Coordinator> Manual Startup type
      (Needs Security Accounts Manager to run)
    Exit Services when through

    I would like you to make sure those 2 areas are set correctly and then let me know if it makes any difference in the system.
     
  10. taniagisell

    taniagisell TS Rookie Topic Starter

    So I did all of what you asked the internet time was the only thing I had to change, everything else was as your said it should be, I did the drag layer and the same thing occurred, I took another log.

    Vino's Event Viewer v01c run on Windows XP in English
    Report run at 28/03/2010 10:08:38 PM

    Note: All dates below are in the format dd/mm/yyyy

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    'Application' Log - error Type
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Log: 'Application' Date/Time: 24/03/2010 6:54:34 PM
    Type: error Category: 0
    Event: 1000 Source: Application Error
    Faulting application firefox.exe, version 1.9.1.3685, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0001b21a.

    Log: 'Application' Date/Time: 20/03/2010 12:25:00 AM
    Type: error Category: 50
    Event: 4609 Source: EventSystem
    The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    'System' Log - error Type
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Log: 'System' Date/Time: 28/03/2010 10:03:20 PM
    Type: error Category: 0
    Event: 29 Source: W32Time
    The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 7883 minutes. NtpClient has no source of accurate time.

    Log: 'System' Date/Time: 28/03/2010 1:28:17 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 27/03/2010 1:54:49 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 27/03/2010 1:46:21 AM
    Type: error Category: 0
    Event: 7000 Source: Service Control Manager
    The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

    Log: 'System' Date/Time: 27/03/2010 1:46:05 AM
    Type: error Category: 0
    Event: 7000 Source: Service Control Manager
    The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

    Log: 'System' Date/Time: 21/03/2010 9:00:16 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 20/03/2010 12:23:49 AM
    Type: error Category: 0
    Event: 7031 Source: Service Control Manager
    The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

    Log: 'System' Date/Time: 20/03/2010 12:23:41 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The DNS Client service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:23:05 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:22:55 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The Kodak AiO Network Discovery Service service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:22:39 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The iPodService service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 20/03/2010 12:22:33 AM
    Type: error Category: 0
    Event: 7034 Source: Service Control Manager
    The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

    Log: 'System' Date/Time: 19/03/2010 9:11:12 AM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 16/03/2010 2:43:44 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 13/03/2010 9:13:14 AM
    Type: error Category: 0
    Event: 29 Source: W32Time
    The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

    Log: 'System' Date/Time: 13/03/2010 9:13:14 AM
    Type: error Category: 0
    Event: 17 Source: W32Time
    Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Log: 'System' Date/Time: 13/03/2010 9:13:06 AM
    Type: error Category: 0
    Event: 29 Source: W32Time
    The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

    Log: 'System' Date/Time: 13/03/2010 9:13:06 AM
    Type: error Category: 0
    Event: 17 Source: W32Time
    Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

    Log: 'System' Date/Time: 06/03/2010 1:25:55 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

    Log: 'System' Date/Time: 20/02/2010 6:10:48 PM
    Type: error Category: 0
    Event: 10010 Source: DCOM
    The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.
     
  11. taniagisell

    taniagisell TS Rookie Topic Starter

    SO it stopped double clicking for a while, then it started again I left it alone for a while and when I got back on it it stopped again.
     
     
  12. Bobbye

    Bobbye Helper on the Fringe Posts: 16,392   +36

    I took considerable time setting things up for you last night. It appears you did not reset the time which is critical: You still show:
    I instructed you to do the following:
    Please reset the time, then move to the Windows OS forum if you think you need more help. This appears to be some system problem, not malware.

    I am closing this thread.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.