Thank you to the guys at HEGE supporting Badcaps [ HEGE ] [ HEGE DEX Chart ]

Announcement

Collapse
No announcement yet.

Where did this come from?

Collapse
X
Collapse
 
  • Page of 2
  • Filter
  • Time
  • Show
Clear All
new posts
Previous 1 2 template Next
    #1

    Where did this come from?

    Last week, my computer suddenly became very slow. When I opened Task Manager, I found a process called setup.exe with 100% CPU usage. When I ended the process, a second GoogleUpdate.exe process started (I have Chrome installed, so one Google Update process is always running). Ending this new GoogleUpdate.exe process ended both processes at the same time, so I thought Chrome was updating.

    Today, I ran Malwarebytes and it found two setup.exe files and a registry key related to the setup.exe file. All were detected as Adware.CNNIC. These were the only three things the scan found. I was using Firefox with AdBlock Plus and NoScript. How did this manage to download?
    Attached Files
    Tags: None
    #2
    Re: Where did this come from?

    Do a full scan not a quick scan and make sure nothing else shows up.

    Comment

      #3
      Re: Where did this come from?

      There is so much crap floating around out there nowadays who knows where it came from.

      I use Microsoft Security Essentials + Malwarebytes + Spybot search and destroy (but not all at the same time) for protection. To keep my temporary file folders and registry clean (seems like these are favorite hiding spots of malware) I use CCleaner.

      Comment

        #4
        Re: Where did this come from?

        A full scan with Malwarebytes and Avast didn't find anything else. The last registry cleaner I used messed up the registry so that no antivirus software would install.

        This computer has done some strange things since I started to connect to the college's wireless network. If I try to open Internet Explorer (the login page for the college's wireless network will only display in Internet Explorer), the window will sometimes close when the home page or login page starts to load.

        Comment

          #5
          Re: Where did this come from?

          Is your system fully up to date with all the patches?
          --- begin sig file ---

          If you are new to this forum, we can help a lot more if you please post clear focused pictures (max resolution 2000x2000 and 2MB) of your boards using the manage attachments button so they are hosted here. Information and picture clarity compositions should look like this post.

          We respectfully ask that you make some time and effort to read some of the guides available for basic troubleshooting. After you have read through them, then ask clarification questions or report your findings.

          Please do not post inline and offsite as they slow down the loading of pages.

          --- end sig file ---

          Comment

            #6
            Re: Where did this come from?

            Usually when I encounter such problems I just say f-it, reformat the drive, and reinstall the OS to make sure its clean.

            Comment

              #7
              Re: Where did this come from?

              Got a good Firewall? I would recommend Comodo Firewall. It's free, and very good!

              Comment

                #8
                Re: Where did this come from?

                Originally posted by shovenose View Post
                Got a good Firewall? I would recommend Comodo Firewall. It's free, and very good!
                The Defense+ engine is the best part of Comodo, I think.


                Anyway, for virus removal I would also suggest a bootable scanner CD, like Bitdefender's Rescue CD for example, much easier to catch things that way, when they're not active and potentially hiding.

                (http://download.bitdefender.com/rescue_cd/)
                "Tantalum for the brave, Solid Aluminium for the wise, Wet Electrolytic for the adventurous"
                -David VanHorn

                Comment

                  #9
                  Re: Where did this come from?

                  Originally posted by lti View Post
                  If I try to open Internet Explorer (the login page for the college's wireless network will only display in Internet Explorer), the window will sometimes close when the home page or login page starts to load.
                  That sounds like it could be faulty RAM... run memtest and see what you get.
                  Originally posted by PeteS in CA
                  Remember that by the time consequences of a short-sighted decision are experienced, the idiot who made the bad decision may have already been promoted or moved on to a better job at another company.
                  A working TV? How boring!

                  Comment

                    #10
                    Re: Where did this come from?

                    If the computer was worth repairing, I would reinstall Windows... after replacing the hard drive, optical drive, battery, keyboard, and touchpad (all need to be replaced).

                    Windows is fully updated, but I am still using Firefox 3.6. I was told that the online portions of my college classes can not be accessed using Firefox 6 or later. I am only using the Windows firewall.

                    I might test the RAM some day.

                    Comment

                      #11
                      Re: Where did this come from?

                      I had one instance where SuperAntiSpyware eliminated a malware, but sometimes none security programs found anything, while free online scans from Symantec, Bit Defender, Trend, Kaspersky, etc., did, although they didn't always provide the solution (had to go elsewhere for that). Also posting a Hijack This log at a computer security forum, like SpywareWarrior.com, can help.

                      Comment

                        #12
                        Re: Where did this come from?

                        Originally posted by Evil Lurker View Post
                        Usually when I encounter such problems I just say f-it, reformat the drive, and reinstall the OS to make sure its clean.
                        Soo QFT!
                        ASRock B550 PG Velocita

                        Ryzen 9 "Vermeer" 5900X

                        16 GB AData XPG Spectrix D41

                        Sapphire Nitro+ Radeon RX 6750 XT

                        eVGA Supernova G3 750W

                        Western Digital Black SN850 1TB NVMe SSD

                        Alienware AW3423DWF OLED




                        "¡Me encanta "Me Encanta o Enlistarlo con Hilary Farr!" -Mí mismo

                        "There's nothing more unattractive than a chick smoking a cigarette" -Topcat

                        "Today's lesson in pissivity comes in the form of a ziplock baggie full of GPU extension brackets & hardware that for the last ~3 years have been on my bench, always in my way, getting moved around constantly....and yesterday I found myself in need of them....and the bastards are now nowhere to be found! Motherfracker!!" -Topcat

                        "did I see a chair fly? I think I did! Time for popcorn!" -ratdude747

                        Comment

                          #13
                          Re: Where did this come from?

                          Originally posted by Evil Lurker View Post
                          To keep my temporary file folders and registry clean (seems like these are favorite hiding spots of malware) I use CCleaner.
                          +1
                          Well, I don't use CCleaner much for the registry, but I do use it to delete all of those junk files. I usually run it before shutdown. You can even make it do this automatically. Just create a second shortcut of CCleaner on your desktop, right click it, click on properties, and then in the "Target" box, type " /AUTO /SHUTDOWN" after the ccleaner.exe name. When you double-click this icon, CCleaner will run and then shutdown the computer. Then just use that instead of the shutdown button in Windows.

                          Comment

                            #14
                            Re: Where did this come from?

                            Originally posted by momaka View Post
                            +1
                            Well, I don't use CCleaner much for the registry, but I do use it to delete all of those junk files. I usually run it before shutdown. You can even make it do this automatically. Just create a second shortcut of CCleaner on your desktop, right click it, click on properties, and then in the "Target" box, type " /AUTO /SHUTDOWN" after the ccleaner.exe name. When you double-click this icon, CCleaner will run and then shutdown the computer. Then just use that instead of the shutdown button in Windows.
                            This is a genious idea!

                            Comment

                              #15
                              Re: Where did this come from?

                              For me, registry cleaners don't do anything good. Updating drivers or the BIOS also have a negative effect on the computer's performance and stability unless the update fixes a known problem.

                              I just remembered that I can't test the memory because the optical drive is dead. The computer can boot from a USB floppy drive, but I don't know if it can boot from a flash drive.

                              Do you think the hard drive is bad?
                              Last edited by lti; 11-04-2011, 05:36 PM.

                              Comment

                                #16
                                Re: Where did this come from?

                                Memtest86+ has floppy images, so if you can boot from your USB floppy that should work.
                                "Tantalum for the brave, Solid Aluminium for the wise, Wet Electrolytic for the adventurous"
                                -David VanHorn

                                Comment

                                  #17
                                  Re: Where did this come from?

                                  Originally posted by lti View Post
                                  For me, registry cleaners don't do anything good.
                                  Yes, many registry cleaners will pick up things they shouldn't. If you know what to delete and what to leave from the list they give you, they can be okay.

                                  Originally posted by lti View Post
                                  Do you think the hard drive is bad?
                                  If that utility is correct, then YES, your HD is going bad.
                                  According to the screenshot you posted, your HD has 160 reallocated sectors, 108 that have been registered as reallocated (Reallocated Event Count) and 300 pending to be remapped (Current Pending Sector).

                                  Try HDD Tune and see what it tells you. If it's the same thing, then the hard drive definitely is going bad.

                                  Comment

                                    #18
                                    Re: Where did this come from?

                                    If that's a report from Speedfan then I would say it's accurate.

                                    That many reallocated sectors, your drive has issues. While it doesn't spell immediate doom, it's a good sign.

                                    Backup your data if not already, and get a new drive. Hopefully you can find someone who hasn't heard of the floods in Thailand.
                                    "Tantalum for the brave, Solid Aluminium for the wise, Wet Electrolytic for the adventurous"
                                    -David VanHorn

                                    Comment

                                      #19
                                      Re: Where did this come from?

                                      Ultra DMA CRC Error Rate 200 21
                                      Offline Uncorrectable Sector Count 1 255
                                      Current Pending Sector 100 300
                                      Reallocated Event Count 100 108
                                      Reallocated Sector Count 100 160
                                      With the exception of the first one, my belief is that these should never be nonzero, otherwise the drive is not reliable and should be replaced. The first one may indicate cable problems.

                                      This is an example of a disk in good condition. (It's getting "old" but I wouldn't worry about that because everything else is perfect.)

                                      Comment

                                        #20
                                        Re: Where did this come from?

                                        Yes but the one in my bedside PC is really good!
                                        Attached Files

                                        Comment

                                        Previous 1 2 template Next
                                        Working...
                                        X