# program opens and closes really fast.



## Lostboss (Jun 16, 2012)

Hello I have had some trouble with my computer for a few months, a unknown program will open in my task bar at the bottom of the screen and close most of the time it happens so fast i can't even get a look at the icon just a flash on my screen, it will kick me out of full-screen if i am watching netfilxs and once kicked me from a game as tho i had hit the windows key.

I am never ask if i want to run a program it it just does it own thing like it owns the place. I managed to get a look at it one because i was running a lot of scanning tools and the computer was running so slow that the program could not close fast enough before i got a look at the icon. 

It had what looked like to be a gear something that looked like a external hard drive and some other thing i could not really tell what it was. I have ran every scan I could think of from 4-5 different anti virus programs and it pulls up nothing. I have thought about a system restore but i have lot of programs i don't want to re-download and have settings i want to keep. 

I am running windows7 and I built the computer if it makes a difference.

I am willing to do a system reinstall everything but im not sure if that will get rid of the program or if the windows disc i got was a 1 time deal, And if it help someone from japan has found out my pass word or something for my yahoo and has logged in to my account im not sure what he has done or if this program is a key logger.
Anything you can do to help would be much appreciated.
Thank you


----------



## A1tecice (Jun 1, 2010)

Hello Lostboss and welcome to TSF!

I suggest we start by giving your computer a full scan via Malwarebytes:
Malwarebytes Anti-Malware - CNET Download.com

Please install this and run a 'full scan' It may take a few hours (this is normal).

Post back any results :wink:

Thanks,
Altie


----------



## Lostboss (Jun 16, 2012)

OK it just finished here is the data.

Malwarebytes Anti-Malware (Trial) 1.61.0.1400
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Database version: v2012.06.17.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Chris :: CHRIS-PC [administrator]

Protection: Enabled

6/16/2012 8:40:52 PM
mbam-log-2012-06-17 (00-13-56).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 575391
Time elapsed: 3 hour(s), 16 minute(s), 55 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 35
HKCR\CLSID\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) -> No action taken.
HKCR\TypeLib\{44444444-4444-4444-4444-440044224458} (Adware.GamePlayLabs) -> No action taken.
HKCR\Interface\{55555555-5555-5555-5555-550055225558} (Adware.GamePlayLabs) -> No action taken.
HKCR\CrossriderApp0002258.BHO.1 (Adware.GamePlayLabs) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158} (Adware.GamePlayLabs) -> No action taken.
HKCR\CLSID\{22222222-2222-2222-2222-220022222258} (Adware.GamePlayLab) -> No action taken.
HKCR\CrossriderApp0002258.Sandbox.1 (Adware.GamePlayLab) -> No action taken.
HKCR\CrossriderApp0002258.Sandbox (Adware.GamePlayLab) -> No action taken.
HKCR\CLSID\{33333333-3333-3333-3333-330033223358} (Adware.GamePlayLab) -> No action taken.
HKCR\CrossriderApp0002258.FBApi.1 (Adware.GamePlayLab) -> No action taken.
HKCR\CrossriderApp0002258.FBApi (Adware.GamePlayLab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{65bcd620-07dd-012f-819f-073cf1b8f7c6} (Adware.GamePlayLab) -> No action taken.
HKCR\CrossriderApp0002258.BHO (Adware.GamePlayLab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I Want This (Adware.GamePlayLabs) -> No action taken.
HKCR\CrossriderApp0002258.BHO (PUP.CrossFire.Gen) -> No action taken.
HKCR\CrossriderApp0002258.BHO.1 (PUP.CrossFire.Gen) -> No action taken.
HKCR\CrossriderApp0002258.FBApi (PUP.CrossFire.Gen) -> No action taken.
HKCR\CrossriderApp0002258.FBApi.1 (PUP.CrossFire.Gen) -> No action taken.
HKCR\CrossriderApp0002258.Sandbox (PUP.CrossFire.Gen) -> No action taken.
HKCR\CrossriderApp0002258.Sandbox.1 (PUP.CrossFire.Gen) -> No action taken.
HKCU\Software\Cr_Installer\2258 (Adware.GamePlayLab) -> No action taken.
HKLM\SOFTWARE\Google\Chrome\Extensions\kincjchfokkeneeofpeefomkikfkiedl (PUP.FCTPlugin) -> No action taken.
HKLM\SOFTWARE\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk (PUP.GamesPlayLab) -> No action taken.
HKLM\SOFTWARE\Google\chrome\Extensions\fdloijijlkoblmigdofommgnheckmaki (PUP.Funmoods) -> No action taken.
HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\mpfapcdfbbledbojijcbcclmlieaoogk (PUP.GamesPlayLab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) -> No action taken.
HKCR\CLSID\{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) -> No action taken.
HKCR\TypeLib\{44444444-4444-4444-4444-440044224458} (PUP.GamePlayLab) -> No action taken.
HKCR\Interface\{55555555-5555-5555-5555-550055225558} (PUP.GamePlayLab) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) -> No action taken.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011221158} (PUP.GamePlayLab) -> No action taken.

Registry Values Detected: 1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\I Want This|Publisher (Adware.GamePlayLab) -> Data: 215 Apps -> No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 5
C:\Program Files (x86)\I Want This (Adware.GamePlayLab) -> No action taken.
C:\Users\Chris\Local Settings\Application Data\I Want This (Adware.GamePlayLab) -> No action taken.
C:\Users\Chris\Local Settings\Application Data\I Want This\Chrome (Adware.GamePlayLab) -> No action taken.
C:\Users\Chris\AppData\Local\I Want This (Adware.GamePlayLab) -> No action taken.
C:\Users\Chris\AppData\Local\I Want This\Chrome (Adware.GamePlayLab) -> No action taken.

Files Detected: 11
C:\Program Files (x86)\I Want This\I Want This.dll (Adware.GamePlayLabs) -> No action taken.
C:\Program Files (x86)\I Want This\I Want This.exe (Adware.GamePlayLabs) -> No action taken.
C:\Program Files (x86)\I Want This\I Want ThisGui.exe (Adware.GamePlayLabs) -> No action taken.
C:\Program Files (x86)\I Want This\Uninstall.exe (Adware.GamePlayLabs) -> No action taken.
C:\Users\Chris\Downloads\ADLSoft_UnCompressor.exe (PUP.Adware.InstallCore) -> No action taken.
C:\Program Files (x86)\I Want This\I Want This.ini (Adware.GamePlayLab) -> No action taken.
C:\Program Files (x86)\I Want This\I Want This.ico (Adware.GamePlayLab) -> No action taken.
C:\Program Files (x86)\I Want This\I Want ThisInstaller.log (Adware.GamePlayLab) -> No action taken.
C:\Users\Chris\Local Settings\Application Data\I Want This\Chrome\I Want This.crx (Adware.GamePlayLab) -> No action taken.
C:\Users\Chris\AppData\Local\I Want This\Chrome\I Want This.crx (Adware.GamePlayLab) -> No action taken.
C:\Program Files (x86)\I Want This\I Want This.dll (PUP.GamePlayLab) -> No action taken.

(end)


----------



## koala (Mar 27, 2005)

If you'd like our security analysts to take a look, please follow these instructions, then start a new thread in the Virus/Trojan/Spyware Help forum and include all the requested log files.


----------



## Lostboss (Jun 16, 2012)

*Important*
Thread has been moved as suggested by Koala , to here 

hxxp://www.techsupportforum.com/forums/f50/program-opens-and-closes-really-fast-651146.html#post3773118

Replace hxxp with http (was told to post link this way in the *NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help post )*

New info has also be posted in the new thread, The only use for this tread is the Info in the 3rd post.

Thank you


----------



## Basementgeek (Feb 7, 2005)

That being done, this thread is closed. Stay with your other one.

BG


----------

