Where did this come from?

[lti]

Last week, my computer suddenly became very slow. When I opened Task Manager, I found a process called setup.exe with 100% CPU usage. When I ended the process, a second GoogleUpdate.exe process started (I have Chrome installed, so one Google Update process is always running). Ending this new GoogleUpdate.exe process ended both processes at the same time, so I thought Chrome was updating.

Today, I ran Malwarebytes and it found two setup.exe files and a registry key related to the setup.exe file. All were detected as Adware.CNNIC. These were the only three things the scan found. I was using Firefox with AdBlock Plus and NoScript. How did this manage to download?

[shovenose]

Re: Where did this come from?

Do a full scan not a quick scan and make sure nothing else shows up.

[Evil Lurker]

Re: Where did this come from?

There is so much crap floating around out there nowadays who knows where it came from.

I use Microsoft Security Essentials + Malwarebytes + Spybot search and destroy (but not all at the same time) for protection. To keep my temporary file folders and registry clean (seems like these are favorite hiding spots of malware) I use CCleaner.

[lti]

Re: Where did this come from?

A full scan with Malwarebytes and Avast didn't find anything else. The last registry cleaner I used messed up the registry so that no antivirus software would install.

This computer has done some strange things since I started to connect to the college's wireless network. If I try to open Internet Explorer (the login page for the college's wireless network will only display in Internet Explorer), the window will sometimes close when the home page or login page starts to load.

[retiredcaps]

Re: Where did this come from?

Is your system fully up to date with all the patches?

[Evil Lurker]

Re: Where did this come from?

Usually when I encounter such problems I just say f-it, reformat the drive, and reinstall the OS to make sure its clean.

[shovenose]

Re: Where did this come from?

Got a good Firewall? I would recommend Comodo Firewall. It's free, and very good!

[Agent24]

Re: Where did this come from?

Got a good Firewall? I would recommend Comodo Firewall. It's free, and very good!

The Defense+ engine is the best part of Comodo, I think.


Anyway, for virus removal I would also suggest a bootable scanner CD, like Bitdefender's Rescue CD for example, much easier to catch things that way, when they're not active and potentially hiding.

(http://download.bitdefender.com/rescue_cd/)

[Th3_uN1Qu3]

Re: Where did this come from?

If I try to open Internet Explorer (the login page for the college's wireless network will only display in Internet Explorer), the window will sometimes close when the home page or login page starts to load.

That sounds like it could be faulty RAM... run memtest and see what you get.

[lti]

Re: Where did this come from?

If the computer was worth repairing, I would reinstall Windows... after replacing the hard drive, optical drive, battery, keyboard, and touchpad (all need to be replaced).

Windows is fully updated, but I am still using Firefox 3.6. I was told that the online portions of my college classes can not be accessed using Firefox 6 or later. I am only using the Windows firewall.

I might test the RAM some day.

[larrymoencurly]

Re: Where did this come from?

I had one instance where SuperAntiSpyware eliminated a malware, but sometimes none security programs found anything, while free online scans from Symantec, Bit Defender, Trend, Kaspersky, etc., did, although they didn't always provide the solution (had to go elsewhere for that). Also posting a Hijack This log at a computer security forum, like SpywareWarrior.com, can help.

[RJARRRPCGP]

Re: Where did this come from?

Usually when I encounter such problems I just say f-it, reformat the drive, and reinstall the OS to make sure its clean.

Soo QFT!

[momaka]

Re: Where did this come from?

To keep my temporary file folders and registry clean (seems like these are favorite hiding spots of malware) I use CCleaner.

+1
Well, I don't use CCleaner much for the registry, but I do use it to delete all of those junk files. I usually run it before shutdown. You can even make it do this automatically. Just create a second shortcut of CCleaner on your desktop, right click it, click on properties, and then in the "Target" box, type " /AUTO /SHUTDOWN" after the ccleaner.exe name. When you double-click this icon, CCleaner will run and then shutdown the computer. Then just use that instead of the shutdown button in Windows.

[shovenose]

Re: Where did this come from?

+1
Well, I don't use CCleaner much for the registry, but I do use it to delete all of those junk files. I usually run it before shutdown. You can even make it do this automatically. Just create a second shortcut of CCleaner on your desktop, right click it, click on properties, and then in the "Target" box, type " /AUTO /SHUTDOWN" after the ccleaner.exe name. When you double-click this icon, CCleaner will run and then shutdown the computer. Then just use that instead of the shutdown button in Windows.

This is a genious idea!

[lti]

Re: Where did this come from?

For me, registry cleaners don't do anything good. Updating drivers or the BIOS also have a negative effect on the computer's performance and stability unless the update fixes a known problem.

I just remembered that I can't test the memory because the optical drive is dead. The computer can boot from a USB floppy drive, but I don't know if it can boot from a flash drive.

Do you think the hard drive is bad?

[Agent24]

Re: Where did this come from?

Memtest86+ has floppy images, so if you can boot from your USB floppy that should work.

[momaka]

Re: Where did this come from?

For me, registry cleaners don't do anything good.

Yes, many registry cleaners will pick up things they shouldn't. If you know what to delete and what to leave from the list they give you, they can be okay.

Do you think the hard drive is bad?

If that utility is correct, then YES, your HD is going bad.
According to the screenshot you posted, your HD has 160 reallocated sectors, 108 that have been registered as reallocated (Reallocated Event Count) and 300 pending to be remapped (Current Pending Sector).

Try HDD Tune and see what it tells you. If it's the same thing, then the hard drive definitely is going bad.

[Agent24]

Re: Where did this come from?

If that's a report from Speedfan then I would say it's accurate.

That many reallocated sectors, your drive has issues. While it doesn't spell immediate doom, it's a good sign.

Backup your data if not already, and get a new drive. Hopefully you can find someone who hasn't heard of the floods in Thailand.

[b700029]

Re: Where did this come from?

Ultra DMA CRC Error Rate 200 21
Offline Uncorrectable Sector Count 1 255
Current Pending Sector 100 300
Reallocated Event Count 100 108
Reallocated Sector Count 100 160

With the exception of the first one, my belief is that these should never be nonzero, otherwise the drive is not reliable and should be replaced. The first one may indicate cable problems.

This is an example of a disk in good condition. (It's getting "old" but I wouldn't worry about that because everything else is perfect.)

[shovenose]

Re: Where did this come from?

Yes but the one in my bedside PC is really good!