G oog le BadWeB | Login/out | Topics | Search | Custodians | Register | Edit Profile

Buell Forum » Quick Board Archives » Archive through July 20, 2009 » HELP! Serious Windows XP craziness! « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

Swordsman
Posted on Saturday, July 11, 2009 - 10:00 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Okay, XP is going nuts! I got a trojan today, but AVG cleaned it up quickly. However, now I'm getting some totally crazy stuff happening. I keep getting these random "click" sounds, like I've hit a button somewhere. Even stranger, I will suddenly start getting audio of some web-based TV stuff! Out of nowhere, I hear an interview with Bruno, and then some other celebrity something-or-other. There's no video, no indication of ANYTHING running. However, a quick check in my Task Manager shows iexplorer.exe up an running, and killing the process stops the audio.

I've run 2 AVG scans, and nothing shows up! Any ideas? This is totally screwy!

~SM
Top of pagePrevious messageNext messageBottom of page Link to this message

Etennuly
Posted on Saturday, July 11, 2009 - 10:04 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Somewhere in the clean up programming you can delete a time period. It takes a section of time back to a time you would pick, like the day before the incident, and in a few minutes it is as if that day never happened.

I can't recall where it is right now. You will loose anything done from date to date, but it fixes amazing messes.
Top of pagePrevious messageNext messageBottom of page Link to this message

Midknyte
Posted on Saturday, July 11, 2009 - 10:05 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

try a different scanner - bitdefender has an online scanner that will save you from installing a second/redundant scanner.

http://www.bitdefender.com/scanner/online/free.htm l
Top of pagePrevious messageNext messageBottom of page Link to this message

Swordsman
Posted on Saturday, July 11, 2009 - 10:32 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Yeah, SOMETHING on here keeps triggering an invisible Internet Explorer. Gotta find whatever it is and shut it down.

~SM
Top of pagePrevious messageNext messageBottom of page Link to this message

Steve_mackay
Posted on Saturday, July 11, 2009 - 11:32 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

download, and run this...
http://www.malwarebytes.org/mbam.php
Top of pagePrevious messageNext messageBottom of page Link to this message

Indy_bueller
Posted on Sunday, July 12, 2009 - 01:16 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Try Microsoft Defender also.
Top of pagePrevious messageNext messageBottom of page Link to this message

Reepicheep
Posted on Sunday, July 12, 2009 - 10:39 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Reinstall windows from scratch... and put on good anti malware software before you start restoring any data.

An expert trying to clean up "post infection" is probably lucky to get it all 60% of the time...
Top of pagePrevious messageNext messageBottom of page Link to this message

Andrejs2112
Posted on Sunday, July 12, 2009 - 11:13 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Try an Apple.
Top of pagePrevious messageNext messageBottom of page Link to this message

Pkforbes87
Posted on Sunday, July 12, 2009 - 02:31 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Kaspersky Internet Security.

I'll never have Norton, McCafee, or others on my PC again. For $30/year this protects better, updates more often, and affects system performance less than other software.

Top of pagePrevious messageNext messageBottom of page Link to this message

Ochoa0042
Posted on Sunday, July 12, 2009 - 03:06 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)



Top of pagePrevious messageNext messageBottom of page Link to this message

Hootowl
Posted on Monday, July 13, 2009 - 10:03 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

"Reinstall windows from scratch... and put on good anti malware software before you start restoring any data.

An expert trying to clean up "post infection" is probably lucky to get it all 60% of the time..."

Yep. There's some really nasty stuff out there now. You'll never get rid of it all. Start over.
Top of pagePrevious messageNext messageBottom of page Link to this message

Swordsman
Posted on Tuesday, July 14, 2009 - 09:08 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

I despise reinstalls. I have entirely too much crap.

I managed to update my AVG, and it found 4 items that it couldn't remove or clean. The actual explorer.exe was one of them, as well as the svchost.exe. I then ran Trendmicro's house call (browser based scan), and it picked up about 6 java items that it did delete. However, I'm still getting the clicks, and IE is still launching itself, though now instead of audio I'm getting error windows. I guess I've nabbed part of it. Maybe with another few days that virus definitions will get updated again and I can get the rest of it.

Just FYI, I managed to pick this thing up through Firefox.

~SM
Top of pagePrevious messageNext messageBottom of page Link to this message

Ochoa0042
Posted on Tuesday, July 14, 2009 - 09:29 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

svchost.exe

what is that?
....because i suspected it was something not normal, but i was never able to get rid of it.. the virus/trojan was a long time ago, and this svchost.exe popped up and has been ever since.
Top of pagePrevious messageNext messageBottom of page Link to this message

Swordsman
Posted on Tuesday, July 14, 2009 - 10:49 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

It's part of the Windows automatic update stuff. It's actually legitimate. I wonder though, when sometimes you have 3 and 4 instances of it running at one time...? And that's when I'm NOT having any problems!

~SM
Top of pagePrevious messageNext messageBottom of page Link to this message

Froggy
Posted on Tuesday, July 14, 2009 - 11:02 am:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Often times they will name the spyware files the same as legit stuff so it will throw you off.

Disable system restore as it can come back in there.

Do the scans after booting into Safe Mode
Top of pagePrevious messageNext messageBottom of page Link to this message

Ochoa0042
Posted on Tuesday, July 14, 2009 - 01:09 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

i've got 11 svchost.exe's
Top of pagePrevious messageNext messageBottom of page Link to this message

Xb12xmike
Posted on Tuesday, July 14, 2009 - 01:59 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

copied:
At startup, Svchost.exe checks the services portion of the registry and constructs a list of services that it needs to load. Under normal conditions, multiple instances of Svchost.exe will be running simultaneously. Each Svchost.exe session can contain a grouping of services, so that many services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.

http://blogs.howtogeek.com/mysticgeek/2009/02/02/s vchost-viewer-shows-exactly-what-each-svchostexe-i nstance-is-doing/
Top of pagePrevious messageNext messageBottom of page Link to this message

Rkc00
Posted on Tuesday, July 14, 2009 - 02:39 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Like Andrejs2112 said.

!!! GET A MAC !!!!

Mike
Long Island, NY
09 XB12X Red/Black
06 VRSCR Blue/Silver
Top of pagePrevious messageNext messageBottom of page Link to this message

Reepicheep
Posted on Tuesday, July 14, 2009 - 03:57 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

If you aren't getting breached on a mac, it isn't because they can't, it's that they don't care. Yet.

http://blogs.zdnet.com/security/?p=758

Macs are better for security. They have a better OS model, a better foundational set of technologies, and a wiser collection of feature implementations.

A good Linux distribution like Ubuntu is better then Mac. For all the same reasons.

Macs are also "de-facto" safer as well... for the same reason there are fewer spotted owl or wolly mamoth epidemics running through the population... the mac space is just not as target rich an environment.

Just don't think a Mac (or linux box) "solves" your security problem. It's more a case where having a mac dodges many problems in many ways for the time being. That shouldn't be minimized, but don't oversell it either.
Top of pagePrevious messageNext messageBottom of page Link to this message

Froggy
Posted on Tuesday, July 14, 2009 - 04:14 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Simply not running your Windows computer as an Administrator account will eliminate 92% of the security vulnerability.
http://www.computerworld.com/s/article/9127318/Rem oving_admin_rights_stymies_92_of_Microsoft_s_bugs? source=rss_topic125

Macs and Linux OS's don't give admin access by default.
Top of pagePrevious messageNext messageBottom of page Link to this message

Swordsman
Posted on Thursday, July 16, 2009 - 11:49 pm:   Edit Post Delete Post View Post/Check IP Print Post    Move Post (Custodian/Admin Only) Ban Poster IP (Custodian/Admin only)

Holy cow, this thing has me bent over and without the courtesy of some lube. Everything catches bits and pieces, but the source is still eluding the scans. I even ran it in safe mode, to no avail (DAMN did that take a long time!).

AND, get this: I can't manually update Windows because it has to be run through Internet Explorer, which has totally crapped out on me. It won't go anywhere without crashing. Absolute genius idea, Mr. Gates. Automatic updates seem to be dead as well. AND I can't install another antivirus program. I can try to run it as much as I like, but it simply disappears.

And I don't have a system restore point. I'm 100%

~SM
« Previous Next »

Add Your Message Here
Post:
Bold text Italics Underline Create a hyperlink Insert a clipart image

Username: Posting Information:
This is a private posting area. Only registered users and custodians may post messages here.
Password:
Options: Post as "Anonymous" (Valid reason required. Abusers will be exposed. If unsure, ask.)
Enable HTML code in message
Automatically activate URLs in message
Action:

Topics | Last Day | Tree View | Search | User List | Help/Instructions | Rules | Program Credits Administration