Strange Happenings

[Joe]

I have received this from one of our Senior Group members, he is using
Windows XP but I don't know the full details of his system. After having a
look at this would it be any help if I was to ask him to install Belarc and
post the results back here.

Any thoughts please?

--

Regards
Joe
Tasmania

Strange things are happening to my computer

Quite often recently when I boot up the computer, when it has gone through
all its procedures and settles down to the normal desktop a message appears
saying that "Your computer may be at risk as your Anti-Virus is turned off."
This is most unusual, as it normally turns on automatically when I boot up.
The problem can be corrected by rebooting, but it is a nuisance.

The other strange thing is that new folders and files have appeared on my
second hard drive that I did not create or put there. One folder is called
8b6ae55c09544b1c1a702640, and contains a file called
msxml4-KB927978-enu.log. The other folder is called
be1b7469380ca9c876f0f5b68e9143, and contains a folder called update, which
in turn contains the following files:

idndl.exe
ie7.cat
iecustom.dll
iereseticons.exe
iesetup.exe'
legitlibm.dll
nlsdl.exe
update.exe
update.exe.manifest
update.inf
update.ver
updspapi.dll browseui.dll
xmllitesetup.exe

As well as folder update, folder be1b7469380ca9c876f0f5b68e9143 contains
files:
admparse.dll
advpack.dll
browseui.dll
corpol.dll
custsat.dll
dxtmsft.dll
dxtrans.dll
extmgr.dll
hmmapi.dll
icardie.dll
icrav03.rat
ie4uinit.exe
ieakeng.dll
ieaksie.dll
ieakui.dll
ieapfltr.dll
iedkcs32.dll
iedw.exe
ieencode.dll
ieframe.dll
ieproxy.dll
iernonce.dll
iertutil.dll
iesetup.dll
ieudinit.exe
ieui.dll
ieuinit.inf
iexplore.exe
imgutil.dll
inetcpl.cpl
inseng.dll
install.ins
jscript.dll
jsproxy.dll
licmgr10.dll
msfeeds.dll
msfeeds.mof
msfeedsbs.dll
msfeedsbs.mof
msfeedssync.exe
mshta.exe
mshtml.dll
mshtml.tlb
mshtmled.dll
mshtmler.dll
msls31.dll
msrating.dll
mstime.dll
occache.dll
occache.ini
pngfilt.dll
shdocvw.dll
shlwapi.dll
spmsg.dll
spuninst.exe
spupdsvc.exe
tdc.ocx
ticrf.rat
url.dll
urlmon.dll
vbscript.dll
vgx.dll
webcheck.dll
webcheck.ini
winfxdocobj.exe
wininet.dll

A file called Shortcut to CD Drive has also appeared.

I have run the latest updated version of my antivirus program on the whole
of my computer (taking about 2 hours) and have come up with nothing.

Do you have any possible explanation? Is my computer in danger?

 

[Malke]

I have received this from one of our Senior Group members, he is using
Windows XP but I don't know the full details of his system. After having a
look at this would it be any help if I was to ask him to install Belarc
and post the results back here.

My newsreader stripped the Senior Group member's information because you put
it below a line, so here is the gist of it:

"Quite often recently when I boot up the computer, when it has gone through
all its procedures and settles down to the normal desktop a message appears
saying that "Your computer may be at risk as your Anti-Virus is turned off."
This is most unusual, as it normally turns on automatically when I boot up.
The problem can be corrected by rebooting, but it is a nuisance.

"The other strange thing is that new folders and files have appeared on my
second hard drive that I did not create or put there. One folder is called
8b6ae55c09544b1c1a702640, and contains a file called
msxml4-KB927978-enu.log. The other folder is called
be1b7469380ca9c876f0f5b68e9143, and contains a folder called update, which
in turn contains the following files:

[snip long list of files]

"A file called Shortcut to CD Drive has also appeared.

"I have run the latest updated version of my antivirus program on the whole
of my computer (taking about 2 hours) and have come up with nothing."

The folder with msxml4-KB927978-enu.log in it is from that particular
Windows Update. The folder can be deleted. The second folder looks like a
folder for Internet Explorer 7. Since I don't have any machines running IE7
(except for the box running Vista), I can't check if this is normal
leftovers from updating to IE7. I suggest you look on the IE7 newsgroup and
also on MVP Sandi Hardmeier's IE7 page for that. Here are the links:

microsoft.public.internetexplorer.general - IE7 newsgroup
http://www.ie-vista.com/ - Sandi's site

As for the shortcut, he probably made that himself. Since we don't know what
antivirus he's using, I don't know why it is having a problem. If the
machine were here in the shop I'd want to make sure the av was a current
version of a good one, the definitions were updated, and that there was no
other non-viral malware present. I'd also look at what is starting up with
Windows.

http://www.elephantboycomputers.com/page2.html#Removing_Malware

That's about all I can do for you with the information you've provided. Post
back with more details if you need more help.

Malke

 

[Rock]

I have received this from one of our Senior Group members, he is using
Windows XP but I don't know the full details of his system. After having a
look at this would it be any help if I was to ask him to install Belarc
and
post the results back here.

Regards
Joe
Tasmania

Strange things are happening to my computer

Quite often recently when I boot up the computer, when it has gone through
all its procedures and settles down to the normal desktop a message
appears
saying that "Your computer may be at risk as your Anti-Virus is turned
off."
This is most unusual, as it normally turns on automatically when I boot
up.
The problem can be corrected by rebooting, but it is a nuisance.

<snip>

Joe what AV program does he use?

 

[Joe]

Thanks Malke and Rock, I will pass any information on that I get back from
him.

Appreciated

 

[Joe]

Hi people,

I just got this from our member who I am trying to help with this issue:


" As for the shortcut, he probably made that himself.As for the shortcut,
he probably made that himself. Since we don't know what antivirus he's
using" to quote you from below. Who is "he."? The antivirus I am using
is VET from Computer Asociates and I always update it the first thing I do
when connecting.

" let me know if there is any more I can tell them." Again, who is
"them?" "


Some of us old blokes seem to get a bit stroppy easily eh?

 

[Malke]

Hi people,

I just got this from our member who I am trying to help with this issue:


" As for the shortcut, he probably made that himself.As for the shortcut,
he probably made that himself. Since we don't know what antivirus he's
using" to quote you from below. Who is "he."? The antivirus I am
using is VET from Computer Asociates and I always update it the first
thing I do when connecting.

" let me know if there is any more I can tell them." Again, who is
"them?" "


Some of us old blokes seem to get a bit stroppy easily eh?

Yes, and frankly I don't have patience with stroppy people, old or not when
all I am trying to do is help them. Explain to your Senior Member that you
are asking for free tech support from skilled volunteers on a newsgroup who
naturally cannot see the Sr. Member's computer. Tell the Sr. Member to 1)
get off his high horse when receiving free help; 2) provide the information
asked for; 3) or break out his wallet and take the machine to a local
professional.

In the meantime, maybe you'll get more help from Rock or another poster. I
have nothing further to say since I don't know anything more about the Sr.
Member's computer. I already told you what steps I would take to start
troubleshooting if the machine were in my shop and that's all I can do. And
please understand that I'm not cross with *you* and am not "shooting the
messenger".

Malke

 

[Rock]

Hi people,

I just got this from our member who I am trying to help with this issue:


" As for the shortcut, he probably made that himself.As for the shortcut,
he probably made that himself. Since we don't know what antivirus he's
using" to quote you from below. Who is "he."? The antivirus I am
using is VET from Computer Asociates and I always update it the first
thing I do when connecting.

" let me know if there is any more I can tell them." Again, who is
"them?" "


Some of us old blokes seem to get a bit stroppy easily eh?

--

Regards
Joe
Tasmania

Joe, I'm not familiar with VET. The only thing I can suggest is he run
through the malware removal steps in the link Make gave, and contact the AV
program's tech support for help.

 

[Joe]

--

Regards
Joe
Tasmania

Yes, and frankly I don't have patience with stroppy people, old or not
when
all I am trying to do is help them. Explain to your Senior Member that you
are asking for free tech support from skilled volunteers on a newsgroup
who
naturally cannot see the Sr. Member's computer. Tell the Sr. Member to 1)
get off his high horse when receiving free help; 2) provide the
information
asked for; 3) or break out his wallet and take the machine to a local
professional.

Thanks Malke, I have already told him what you suggested and his reply is
quite curt, not that it worries me. Unfortunately some of our members seem
to think that I am at their beck and call but won't take any notice of the
advice that I give them, a lot of it coming from these groups too. As you
can see I'm not a skilled volunteer but I am a volunteer and like everyone
else I do appreciate a bit of thanks

In the meantime, maybe you'll get more help from Rock or another poster. I
have nothing further to say since I don't know anything more about the Sr.
Member's computer. I already told you what steps I would take to start
troubleshooting if the machine were in my shop and that's all I can do.

He doesn't seem as though he wants to take any advice so I hope he realises
his destination when he get there )))

And please understand that I'm not cross with *you* and am not "shooting
the

messenger".

Never thought that for a moment mate

 

[Joe]

--

Regards
Joe
Tasmania

Joe, I'm not familiar with VET. The only thing I can suggest is he run
through the malware removal steps in the link Make gave, and contact the
AV program's tech support for help.

Thanks Rock, as you will see by the reply to Malke he doesn't seem to want
to take any advice so I'm not going to waste me time on him either.