Help- got some kind of virus, TeaTimer.exe uses 100% resources

[cam35pilot]

HI,
I have Norton 360 on my Dell PC. I brought home a USB flash drive
with a file from work, and had Norton Scan it as I usually do. It
immediately popped up "no viruses found" which I knew was bunk, since
Norton usually takes at least a minute or two to scan these 128MB
drives.
When I tried to open MyComputer again to re-scan it, the PC froze
up. I ran spybot in Safe mode, and it found a bunch of things, but
nothing too nefarious looking. I then got Norton to run after a few re-
boots, but only after I terminated the "TeaTimer.exe", which was
using 100% of the CPU resources.
Norton said no virus, but unless I terminate the TeaTimer.exe
right upon start-up, the PC is just locked up. Norton does pop-up and
says "Norton 360 is processing threats", but doesn't list anything
after I scan it.
Any ideas on what this might be? Can you direct me to a good Anti-
virus forum? Is TeaTimer.exe something that can be deleted and
replaced, if it is indeed infected?

Thanks,
Rich

 

[Leonard Grey]

TeaTimer is part of Spybot Search and Destroy.

 

[cam35pilot]

TeaTimer is part of Spybot Search and Destroy.
---
Leonard Grey
Errare humanum est





- Show quoted text -

I also had two instances of CCSVCHST.EXE running, one taking up 68% of
memory usage. I ended that, and it went right down to 3% CPU usage. It
seems to me that this is where the infection is.

Rich

 

[Leonard Grey]

CCSVCHST.EXE is part of Norton-brand software. It's known as the
Symantec Service Framework and displays the GUI (Graphical User
Interface) of Norton products, which usually include the Norton Security
Suites.

You can learn a lot with Google.

 

[Kayman]

HI,
I have Norton 360 on my Dell PC.

My sincere commiserations.

I brought home a USB flash drive
with a file from work, and had Norton Scan it as I usually do. It
immediately popped up "no viruses found" which I knew was bunk, since
Norton usually takes at least a minute or two to scan these 128MB
drives.
When I tried to open MyComputer again to re-scan it, the PC froze
up. I ran spybot in Safe mode, and it found a bunch of things, but
nothing too nefarious looking. I then got Norton to run after a few re-
boots, but only after I terminated the "TeaTimer.exe", which was
using 100% of the CPU resources.

TeaTimer is a (troublesome) addition in Spybot S&D.

Norton said no virus, but unless I terminate the TeaTimer.exe
right upon start-up, the PC is just locked up. Norton does pop-up and
says "Norton 360 is processing threats", but doesn't list anything
after I scan it.
Any ideas on what this might be? Can you direct me to a good Anti-
virus forum?

Sure (not a forum but a couple of newsgroups):-
microsoft.public.security.virus
alt.comp.virus

Is TeaTimer.exe something that can be deleted and replaced, if it is
indeed infected?

Spybot S&D has lost its luster and Norton 360 is an outrages resource hog.

Suggest you uninstall these programs and go for good-quality (free)
alternatives.

The Norton Removal Tool uninstalls all Norton
2009/2008/2007/2006/2005/2004/2003 products, Norton 360 and Norton
SystemWorks 12.0 from your computer.
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

Re-activate the build-in firewall.

Download/update/execute
Malwarebytes© Corporation - Anti-Malware
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol
--or--
http://majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
--direct--
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
http://www.superantispyware.com/superantispywarefreevspro.html
--direct--
http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

Both free versions of MBAM and SAS are on-demand scanners and offer no
'real-time' protection. Keep them installed and use them as
'second-opinion' scanner which is purposely (by design) recommended by
their respective authors.

Windows Defender - Free (real-time program)
http://www.microsoft.com/athome/security/spyware/software/default.mspx
WD monitors the start-registry and hooks registers/files to prevent spyware
and worms to install to the OS.
Interesting reading:
http://www.pcworld.com/article/id,136195/article.html
"...Windows Defender did excel in behavior-based protection, which detects
changes to key areas of the system without having to know anything about
the actual threat."

Avira AntiVir® Personal - FREE Antivirus
http://www.free-av.com/
(The free version won't scan your emails.)
Why You Don't Need Your Anti-Virus Program to Scan Your E-Mail
http://thundercloud.net/infoave/tutorials/email-scanning/index.htm
Ensure your e-mail program is configured to display e-mail messages in
'Plain Text' only.
You may wish to consider removing the 'AntiVir Nagscreen'
http://www.elitekiller.com/files/disable_antivir_nag.htm

Also:
Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://www.5starsupport.com/ipboard/index.php?showforum=18
http://www.theeldergeek.com/forum/index.php?s=2e9ea4e19d3289dd877ab75a8220bff6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

Finally:
Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html
Hundreds Click on 'Click Here to Get Infected' Ad
http://www.eweek.com/article2/0,1895,2132447,00.asp


Good luck

 

[Gerry]

As you say Leonard

[edit] Incompatibility claims
Norton Internet Security
The makers of Spybot-S&D have come into conflict over claims of
incompatibility with Norton Internet Security.[13] Symantec recommends
uninstalling Spybot-S&D before installing Norton Internet Security.
According to Safer Networking, no satisfactory explanation has been provided
to them for this decision. Antivirus professional Mary Landesman suggests a
possible explanation may stem from a graphical glitch in TeaTimer module's
confirmation dialog. An official explanation from Safer Networking[14]
states that this error stemmed from a bug in the program used to build their
code. The result of the bug was that users had difficulty enabling Norton
Internet Security to make necessary changes to critical registry areas, such
as allowing itself to launch on startup. Aside from this Mary Landesman,
like Safer Networking, concludes that the two programs have no issue with
one another. The bug exists only in the 1.4 version of Spybot-Search &
Destroy and has been fixed as of the 1.5 release.[15]
Source:
http://en.wikipedia.org/wiki/Spybot_-_Search_&_Destroy#Incompatibility_claims

I am now using Spybot 1.6.2.


--


Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~