[Resolved] Double click virus

Status
Not open for further replies.

taniagisell

Posts: 10   +0
So I've had the doubleclick.net adware for a while now. I've done multiple antivirus scans and it never caught it, I used super anti virus and anti-malware a while ago and it caught something I deleted it and but it came back worse. Everything I clicked was a double click, and things closed on me constantly. Right now I did the eight step process including the two cleanings and I think it is gone now. I am posting my logs just in case you guys spot something wrong.
 

Attachments

  • SUPERAntiSpyware Scan Log - 03-27-2010 - 14-34-42.log
    465 bytes · Views: 40
  • mbam-log-2010-03-27 (14-15-28).txt
    857 bytes · Views: 28
  • hijackthis.log
    7.4 KB · Views: 22
I think you're referring to the Tracking Cookies:

To prevent:
Internet Explorer: Tools or Control Panel> Internet Options> Security tab> Restricted Sites> Sites> type each of the following in and click on Add after each:

*.doubleclick.net
*.doubleclick.com


Then click on Apply> OK

For Firefox: Tools> Privacy> Cookies> Exceptions: type each of the following, then Block after each:
*.doubleclick.net
*.doubleclick.com


Be sure to use the * as it is a Wild Card.

Better also, reset Cookies in both:

For Internet Explorer: Internet Options (through Tools or Control Panel) Privacy tab> Advanced button> CHECK 'override automatic Cookie handling'> CHECK 'accept first party Cookies'> CHECK 'Block third party Cookies'> CHECK 'allow per session Cookies'> Apply> OK.

For Firefox: Tools> Options> Privacy> Cookies> CHECK ‘accept Cookies from Sites’> UNCHECK 'accept third party Cookies'> Set Keep until 'they expire'. This will allow you to keep Cookies for registered sites and prevent or remove others. (Note: for Firefox v3.5, after Privacy click on 'use custom settings for History.')

I suggest using the following two add-on for Firefox. They will prevent the Tracking Cookies that come from ads and banners and other sources:
AdBlock Plus
Easy List

Congratulations! Your logs are clean. And now you have the tracking Cookies under control.
 
So, the problem returned as soon as I put my SD card in when I began to choose pictures from my camera on it my clicks became double clicks again. Is it possible that the cookies are in the SD card now? I had put it in while the problem was going on a few days ago, or is this a problem with the mouse?
Should I run the cleaner again, while the SD card is in?
Double clicking is not happening online, it isn't happening when I am using firefox, only on my desktop mainly on Adobe Photoshop.
 
Okay, it's obvious we're talking about 2 different things! "doubleclick.net" is the name of a Domain. I guess they thought it was clever because most people have a 'double click' set to open files. Here are some other ones:
Common Tracking Cookies:
.112.2o7.net
.2o7.net
.ad.yieldmanager.com
.ad.yieldmanager.com
.adrevolver.com
.ads.pointroll.com
.advertising.com
.atdmt.com
.bluestreak.com
.as.casalemedia.com
.doubleclick.net
.fastclick.net
.mediaplex.com
.realmedia.com
.statcounter.com
.trafficmp.com
.tribalfusion.com

These are usually embedded in a banner or ad on a site. And if 3rd party Cookies are allowed, you can get another one any time the site you're on has the Cookie embedded. But it's not a virus, it's not even spyware- although some, like myself, don't want anything tracking me!

The # of clicks to open is set in Folder Options:

Control Panel (or Tools)> Folder Options> General tab> Click items as follows> Choose :
  • Single click to open (point to Select)
    OR
  • Double click to open (single click to Select)

    Then Click on Apply> OK

    As for the mouse itself, the # of clicks is set in Folder Options, but the buttons to use for those clicks are set in Control Panel> Mouse> Buttons tab.

    What I told you are restricting the domains was correct. Resetting the Cookies was correct.

    Why are you thinking this is some kind of virus? Did this start happening all of a sudden? Had you done anything before like update, download, etc. Maybe the SD card can't read the single click. I don't have any problem with that.

    But if you mean something else specifically other than what I've given you, you're going to have to clarify it for me. Just to be sure I did a search for 'doubleclick virus' and was amazed at how many users are asking about it!

    Read Chris' description of Tracking Cookie here: http://chris.pirillo.com/what-is-a-tracking-cookie/
 
Yes, it did start suddenly out of nowhere. I don't remember downloading anything large besides Manycam, I don't use p2p shareware. The only thing I download are word files off my professor's blackboard pages.
I call it a virus because it is not only happening when I am browsing it happens on my desktop, when I'm looking through my files and when I am using programs like paint or photoshop. I will click on something and it will open, I will try to select multiple images by selecting them and using CTR but It will double click the first time and i have to select images one by one. I will try to drag a layer and the whole program will close down for reason's unknown.
 
A file doesn't have to be large to have adware with it. When did you download Manycam? did you have the problem before- or did it start after?

I need you to get away from the 'double click' terminology for a bit:

I will try to drag a layer and the whole program will close down for reason's unknown.
There's always a reason- you just don't know what it is yet. Right after this crashes, I'd like you to do this:

Please download VEW and save it to your Desktop:

Setting up the program

Double-click VEW.exe then under Select log to query, select:
  • Application
    [*] System



    Under Select type to list, select:
  • Critical (Vista only)
  • Error

    Click the radio button for Number of events
  • Type 20 in the 1 to 20 box
  • Then click the Run button.
  • Notepad will open with the output log.

    Load the log
  • In Notepad, click Edit> Select all
  • Then press Edit > Copy
  • Press Ctrl+V on your keyboard to paste the log to your next reply.

(Courtesy rev-Olie)

I'll look over the Events. If I can spot something, I'll try to help. If not, I'll refer you to the Windows OS forum.
 
Vino's Event Viewer v01c run on Windows XP in English
Report run at 28/03/2010 8:24:06 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 24/03/2010 6:54:34 PM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application firefox.exe, version 1.9.1.3685, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0001b21a.

Log: 'Application' Date/Time: 20/03/2010 12:25:00 AM
Type: error Category: 50
Event: 4609 Source: EventSystem
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 28/03/2010 1:28:17 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 27/03/2010 1:54:49 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 27/03/2010 1:46:21 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

Log: 'System' Date/Time: 27/03/2010 1:46:05 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

Log: 'System' Date/Time: 21/03/2010 9:00:16 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 20/03/2010 12:23:49 AM
Type: error Category: 0
Event: 7031 Source: Service Control Manager
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

Log: 'System' Date/Time: 20/03/2010 12:23:41 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The DNS Client service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:23:05 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:22:55 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Kodak AiO Network Discovery Service service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:22:39 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The iPodService service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:22:33 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 19/03/2010 9:11:12 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 16/03/2010 2:43:44 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 13/03/2010 8:13:14 AM
Type: error Category: 0
Event: 29 Source: W32Time
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

Log: 'System' Date/Time: 13/03/2010 8:13:14 AM
Type: error Category: 0
Event: 17 Source: W32Time
Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Log: 'System' Date/Time: 13/03/2010 8:13:06 AM
Type: error Category: 0
Event: 29 Source: W32Time
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

Log: 'System' Date/Time: 13/03/2010 8:13:06 AM
Type: error Category: 0
Event: 17 Source: W32Time
Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Log: 'System' Date/Time: 06/03/2010 12:25:55 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 20/02/2010 5:10:48 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 11/02/2010 9:09:35 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {6A972E27-93E2-4F98-8367-4101B2073814} did not register with DCOM within the required timeout.
 
Give this a try please:

Right click on the Clock in the Notificarion Area, right bottom> click on 'Adjust Date/Time':
  1. Date/Time tab: be sure the correct date and time are set>
  2. Time Zone tab> Make sure the correct Time Zone is set for your location> Check 'Automatically adjust time for Daylight Time'>
  3. Internet Time tab> Check 'Automatically Synchronize time with the internet time server'> copy the time server below:
    tick.usno.navy.mil
    Paste this time server in the dialog box
  4. Click on 'Update Time'> after the time correction click on Apply> OK
==================================
The DCOM problems can have several different causes: Please make sure the following Services running on your machine as indicated: To access the Services:

Click on Start> Run> type in services.msc> double click on the Service to open:
  1. - Com+ Event System> Manual Startup type (needed by SENS Service)
    [*]- Com+ System Application> Manual Startup type
    [*]- DCOM Server Process Launcher> Automatic Startup type
    [*]- Distributed Transaction Coordinator> Manual Startup type
    (Needs Security Accounts Manager to run)
Exit Services when through

I would like you to make sure those 2 areas are set correctly and then let me know if it makes any difference in the system.
 
So I did all of what you asked the internet time was the only thing I had to change, everything else was as your said it should be, I did the drag layer and the same thing occurred, I took another log.

Vino's Event Viewer v01c run on Windows XP in English
Report run at 28/03/2010 10:08:38 PM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 24/03/2010 6:54:34 PM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application firefox.exe, version 1.9.1.3685, faulting module ntdll.dll, version 5.1.2600.5755, fault address 0x0001b21a.

Log: 'Application' Date/Time: 20/03/2010 12:25:00 AM
Type: error Category: 50
Event: 4609 Source: EventSystem
The COM+ Event System detected a bad return code during its internal processing. HRESULT was 800706BA from line 44 of d:\comxp_sp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Please contact Microsoft Product Support Services to report this error.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 28/03/2010 10:03:20 PM
Type: error Category: 0
Event: 29 Source: W32Time
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 7883 minutes. NtpClient has no source of accurate time.

Log: 'System' Date/Time: 28/03/2010 1:28:17 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 27/03/2010 1:54:49 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 27/03/2010 1:46:21 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

Log: 'System' Date/Time: 27/03/2010 1:46:05 AM
Type: error Category: 0
Event: 7000 Source: Service Control Manager
The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

Log: 'System' Date/Time: 21/03/2010 9:00:16 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 20/03/2010 12:23:49 AM
Type: error Category: 0
Event: 7031 Source: Service Control Manager
The Remote Procedure Call (RPC) service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Reboot the machine.

Log: 'System' Date/Time: 20/03/2010 12:23:41 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The DNS Client service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:23:05 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:22:55 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Kodak AiO Network Discovery Service service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:22:39 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The iPodService service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 20/03/2010 12:22:33 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Application Layer Gateway Service service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 19/03/2010 9:11:12 AM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 16/03/2010 2:43:44 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 13/03/2010 9:13:14 AM
Type: error Category: 0
Event: 29 Source: W32Time
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

Log: 'System' Date/Time: 13/03/2010 9:13:14 AM
Type: error Category: 0
Event: 17 Source: W32Time
Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Log: 'System' Date/Time: 13/03/2010 9:13:06 AM
Type: error Category: 0
Event: 29 Source: W32Time
The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time.

Log: 'System' Date/Time: 13/03/2010 9:13:06 AM
Type: error Category: 0
Event: 17 Source: W32Time
Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

Log: 'System' Date/Time: 06/03/2010 1:25:55 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.

Log: 'System' Date/Time: 20/02/2010 6:10:48 PM
Type: error Category: 0
Event: 10010 Source: DCOM
The server {C7E39D60-7A9F-42BF-ABB1-03DC0FA4F493} did not register with DCOM within the required timeout.
 
SO it stopped double clicking for a while, then it started again I left it alone for a while and when I got back on it it stopped again.
 
I took considerable time setting things up for you last night. It appears you did not reset the time which is critical: You still show:
Event: 17 Source: W32Time
Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time-a.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)

I instructed you to do the following:
Right click on the Clock in the Notification Area, right bottom> click on 'Adjust Date/Time':

1. Date/Time tab: be sure the correct date and time are set>
2. Time Zone tab> Make sure the correct Time Zone is set for your location> Check 'Automatically adjust time for Daylight Time'>
3. Internet Time tab> Check 'Automatically Synchronize time with the internet time server'> copy the time server below:
tick.usno.navy.mil
Paste this time server in the dialog box
4. Click on 'Update Time'> after the time correction click on Apply> OK

Please reset the time, then move to the Windows OS forum if you think you need more help. This appears to be some system problem, not malware.

I am closing this thread.
 
Status
Not open for further replies.
Back