Spyware, viruses, & security forum: virus updates my computer

by: KenMcd4 May 13, 2013 7:56 AM PDT

Like this

0 people like this thread

Staff pick

Resolved question

virus updates my computer

by KenMcd4 - 5/13/13 7:56 AM

Sorry for the big messy post. I have a virus(I think), it happens at random

What it does is upon shutdown it starts what looks like a windows update then shutdowns. On restart it continues the update. The update then fails then reverts. This all takes around an hour. Once the netbook has booted there appears a hiden desktop.ini file and 2 shortcuts saying korean messenger and media player, like link to crappy looking websites.

first thing when I googled is 2 forums saying to have these shortcuts is normal and is a requirement of the korean goverment with microsoft when the korean language pack is installed. For one i dont believe that, why install shortcuts that link to crappy looking websites, when i dont have the korean language pack installed. Maybe I got a dodgy windows update involving all the language packs.

I've ran several scans(in safe without networking mode) from different virus software and mostly nothing. One scan found some stuff in some installation files
Win32/bundled.toolbar.ask.application
Win32/toolbar.babylon.c application and something to do with ask.com. Further research into this has found nothing.
Spybot rootkit scan finds 10,000 + things then adds this may not be malware. Plus the stupid cant mass delete them and it links to this recursive application data where it goes 15 folders deep repeating itself. I found one website saying this is normal behaviour due to the way windows was programmed.

looking around my C:\ I've not sure exactly if what i'm looking at are infected files or whats supposed to be there. Many folders have access denied, or protected by trusted installer(legit), or difficult to remove. Many folders have exe.mui files and many folders like ko-kr and en-us. Language pack stuff i find, but it seems strange they seem to be in so many folders for so many programs. Also many folders, .ini files also have the same creation date and time 14/7/09 or another date. Also seems strange

Sometime i look at files that are prefetch(.pf) or in windows\winsxs folders and wonder if they are part of it also

I've had a boot scan to run when it does it again, but that turned up nothing, the last time it did i decided to run safe mode, but i think it got ignored, but the usual windows update screen didnt appear and instead just a black screen with single line text showing all the files getting updated approx 60,000 files.it stopped at 10,000 and returned to the windows update screen, but this time it finished its update very fast and didnt install the shortcuts

I got a couple of file1 error 42125 zip archive corrupted in some scans from stuff in my d drive, but i've figured they arnt anything to worry about

I scan my eyes over my c:\ files think, google them, delete a couple now and then
I have a search program to search for any strange files that I come across

I have been able to apply normal windows updates. Btw i turned the update service off, I scan the task manager processes to see if anything strange turns up then wonder if stuff like winlogon.exe should be in those locations on my computer

my files are all ok for now

I'm basically working on reinstalling as it looks like I my c drive is messed up,but i really want to get this thing
i am running windows 7 starter

one time after reboot and the desktop loaded there was a box in the centre of the screen saying main_wnd or main-wnd. A google gave me the impression this might have something to do the the C++ coding language. You see there just to much to google to try and work out. I feel like I'm research how to make an anti-virus program itself.

one thing is there a program I can get that runs at shutdown and monitors which files get changed or what is running when this update is happening

Am i remotely hijacked, spyware,virus, it prob came off some program i downloaded

Can anyone recommend other forums for this sort of thing

is it worth to try and decipher the scheduled tasks in the system tools or monitor monitor bandwidth as well

tried, avira, avast, malwarebytes, spybot, avg, oh yeah, avast would not install it was blocked, so downloaded this thing called chameleon which installed it,but strangely the chameleon folder seemed to fill up with strange files as well.

it seems to do it at random, but usually every 3-4 days, but the pattern does change. it used to do the whole update thing in one go, no reboot, its seems to do it 2 shutdowns in a row also at the moment


Anyone want to help me with this mystery, has the korean goverment cornered microsoft into making shortcuts appear on my computer? Do I have a virus playing a continous update on me that going to make my computer explode. Whats the point. Is there a virus at all. Can i get rid of it and return my file system to normal?

Forum Icon Legend

  • UnreadUnread
  • ReadRead
  • Locked threadLocked thread
  •   
  •   
  •   
  •   
  •   
  •   
  •   
  • ModeratorModerator
  • CNET StaffCNET Staff
  • Samsung StaffSamsung Staff
  • Norton Authorized Support TeamNorton Authorized Support Team
  • AVG StaffAVG Staff
  • avast! Staffavast! Staff
  • Webroot Support TeamWebroot Support Team
  • Acer Customer Experience TeamAcer Customer Experience Team
  • Windows Outreach TeamWindows Outreach Team
  • DISH staffDISH staff
  • Dell StaffDell Staff
  • Intel StaffIntel Staff
  • QuestionQuestion
  • Resolved questionResolved question
  • General discussionGeneral discussion
  • TipTip
  • Alert or warningAlert or warning
  • PraisePraise
  • RantRant

You are e-mailing the following post: Post Subject

Your e-mail address is used only to let the recipient know who sent the e-mail and in case of transmission error. Neither your address nor the recipient's address will be used for any other purpose.

Sorry, there was a problem emailing this post. Please try again.

Submit Email Cancel

Thank you. Sent email to

Close

Thank you. Sent email to

Close

You are reporting the following post: Post Subject

If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.

Offensive: Sexually explicit or offensive language

Spam: Advertisements or commercial links

Disruptive posting: Flaming or offending other users

Illegal activities: Promote cracked software, or other illegal content

Sorry, there was a problem submitting your post. Please try again.

Submit Report Cancel

Your message has been submitted and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.

Close

Your message has been submitted and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.

Close

You are posting a reply to: Post Subject

The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to the CNET Forums policies for details. All submitted content is subject to CBS Interactive Site Terms of Use.

You are currently tracking this discussion. Click here to manage your tracked discussions.

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

Sorry, there was a problem submitting your post. Please try again.

Sorry, there was a problem generating the preview. Please try again.

Duplicate posts are not allowed in the forums. Please edit your post and submit again.

Submit Reply Preview Cancel

Thank you, , your post has been submitted and will appear on our site shortly.

Close

You are requesting a clarification of the question: Post Subject

The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to the CNET Forums policies for details. All submitted content is subject to CBS Interactive Site Terms of Use.

You are currently tracking this discussion. Click here to manage your tracked discussions.

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

Sorry, there was a problem submitting your post. Please try again.

Sorry, there was a problem generating the preview. Please try again.

Submit Clarification Request Preview Cancel

Thank you, , your post has been submitted and will appear on our site shortly.

Close

You are posting an answer to the question: Post Subject

The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to the CNET Forums policies for details. All submitted content is subject to CBS Interactive Site Terms of Use.

You are currently tracking this discussion. Click here to manage your tracked discussions.

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

Sorry, there was a problem submitting your post. Please try again.

Sorry, there was a problem generating the preview. Please try again.

Submit Answer Preview Cancel

Thank you, , your post has been submitted and will appear on our site shortly.

Close
close

Click here to be notified via e-mail when someone submits an answer.

Would you like to resolve this question? close

Based on your response, it looks like this question has been answered.



Sorry, there was a problem resolving this question. Please try again.

Resolve Leave unresolved