A Problem or Not?

Hi,

I have Winows XP Pro X64, SATA.

I ran Disk Cleanup last night. I also went into Tools -> Internet Options -> General tab -> Delete -> Temporary Files, Cookies and History and deleted all those files.

I also ran SpyBot S&D, AdAware and a full scan using Microsoft Malicous Software Removal Tool. None of these programs found a problem.


Before I went to bed last night, I started an Avast scam. It came up with hundreds of these:

Unable to scan. Archive is password protected.


It also found 3 of these:

Unable to scan: The file is a decompression bomb


I'm not concerned about "Archive is password protected." . . Avast might have found these files because I didn't scan in Safe Mode. I'll scan in Safe Mode tonight to see if these files are still in the scan results.


The other group has me concerned . . . Unable to scan: The file is a decompression bomb.

I Googled it and there were mixed opinions regarding whether they're just large zip files or something that I need to remove.

Would someone let me know if they've encountered this and what I should do with the decompression bombs?

At this point, I don't want to run the full program that Major Geeks recommends because it usually takes about 2 days to run all those scans. If you believe that the compression bombs are dangerous, I'll run all the other programs. I have X64 and can't run CCleaner. It removes a few files that X64 needs.

Thanks . . . Denise

 

Hi Tim . . . it's nice to "see" you again. I'm on the baby that you recommended . . . I built it myself, if you remember and you helped me pick out some of the parts that I needed. I finally decided to start building it about 8 months after I received everything in the mail . . . I was a big chicken to start it.

Anyway, thanks for the link. It sound like it's not a problem but if I run another Avast scan and it finds them again, can I delete them or are they files that are needed? My pc is running very slow. I have 4 sticks of RAM for a total of 3G and I've tried them in every configuration with no speed gained. I'm wondering if these hugs lumps of files might be giving my pc a problem by just being there, even if they're not doing anything.

Denise

 

Hi,

I'll run another Avast scan during the night and get the correct info and start a new thread with it in the Software Forum.

But I just ran AdAware and Microsoft Malicious Spyware Removal Tool. They found nothing. I then ran SpyBot S&D and it found ELITUM.ELITEBAR.POKAPOKA. The info that Spybot S&D found said that it's

Spybot S&D found it once before, about a week ago, and I deleted it but it came back again. I Googled it but there was very little to no info in the search results. I had emptied my temp internet folder, cookies folder and history folder in Tools > Internet Options and ran Disk Cleanup before I ran the scans but the file wasn't deleted until I ran Spybot S&D.

Denise

 

I have a thread in the Software Forum. Adrenylin suggested that I run the MajorGeeks Malware Removal Procedure but I want to wait until I do a clean boot and go into Safe Mode and run Avast tonight.

This problem stayed with the computer after I did a complete reformat and installed the mobo software and Windows XP X64, so I don't think it's something that I picked up afterwards. The more programs I installed, the slower it became. The programs I installed are safe programs, such as Avast, Microsoft Works, MGI Photo Suite, WinZip, Media Player Classic, printer software, and some video programs such as VirtualDub, AC3 Filter, avisynth, Nero, ect, nothing dangerous from an iffy site.

I'll let you know the results of running Avast in Safe Mode and performing a clean boot.

Denise

 

I did a clean boot and it resolved the problem I was having with the slow speed of my pc. It's now faster than it ever was. What does a clean boot do?

I ran Avast and Microsoft Malicious Software last night. Microsoft found no problems. Avast found about 30 objects and I put them in a chest. There wasn't a way to copy the names of the files so these are a sample of the Avast results:

C:\SPYBOT-S&D\RECOVERY\ELITUMELITE\POKAPOKA.ZIP\irsetup.exe
also the same for \sbrecovery.ini, \irsetup.exe and \sbrecovery.ini (2 each) POKAPOKA is a zip file in C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\RecoverySpyBot S&D scan. Could it be the original file that I deleted and SpyBot has it secured in this folder?

C:\DownloadedFileS\Security Programs\Ad-Aware\aawepersonal.exe\%MAINDIR%\Skins\Ad-Aware Se default.ask\bck1.bmp and also for \SE Default.skn

C:\DownloadedFiles\Video\net framework dotnetvx 090505.exe\[Embedded#000ee12]\msi.dll


If they're not malware, should I put the files back?

Denise

 

ugh :hammer:cry:***

 

It's not the length of the instructions or running the scans and obtaining the reports, it's the length of time that my computer will be out of commission. We're joined at the hip, you see, and the length of time it takes to run the scans is the length of time that I can't do anything with it.

I tried to run Panda but it wouldn't load. I turned off Avast, AVG and Windows Firewall and it still couldn't download. Avast went out of its mind when I first tried to download Panda, lol . . . I got a siren and everything!

I'll be starting all the scans soon, so I'll see you in a day or two.

 

The fact that I have X64 made fast work of the procedures:

I downloaded and installed these programs but they can't run because I have XP Pro X64:

- GetRunKey
- CounterSpy
- ShowNew
- Panda
- CCleaner because it deletes some files that are necessary for X64.

The programs that I was able to run were:

- BitDefender (report is attached). BitDefender reported that it could not fix the threats that it found.

- AVG Antispyware - (no report was generated even though I checked the box to generate a report prior to scanning. It found 10 cookies that were medium threats and 2 cookies that were high threats. The 2 high threat tracking cookies were Backdoor.Hupigon (Ahead Nero). I chose “Delete” for all of them and they were deleted.

- Spybot S&D - No threats were found

Should I run HighjackThis?

 

I made an error in my last post. I was able to download

- GetRunKey
- CounterSpy
- ShowNew
- Panda

but I couldn't install them.

After I deleted the files that were found by AVG, I toggled off System Restore and created a new restore point. If deleting the files that Bit Defender found (I hope somebody can tell me how to do it), I'll toggle System Restore and create a new restore point.

Denise

 

Also, I read the info at link that you gave me.

Typically such a bomb is a multi-level packing thing -- data's compressed with one packer (e.g. into a zip), then the resulting archive file is in turn packed (usually with a different packer), and so on several times.

If this is true, some of the files in my hdds might be as large as a couple hundred gig. It would explain why I have 2 ext hdds, each 320G, one for original files and one for backups, and one has about 150G available and the other has only about 62G available. I checked in properties and they both have the same number of files. Since they both have hundreds of files on them, I did a quick side by side comparison of the size of the files on each drive in case one didn't have the Excel worksheet, etc, in it.

So my question here is, can I delete those compression bombs or would it cause more damage than good? Right now I have them in quarantine.

Denise

 

As I said, GetRun and ShowNew both said that they're not compatible with X64. Those weren't the exact words but it said that it can't be installed because I have X64.

Panda wouldn't work for the same reason . . . I have X64.

I never said that I want to delete my backups. I asked if the the bombs were a problem and, if they were a problem, how would I delete them.

I've given you the bdscan because I couldn't install the other programs. I thought that since I couldn't do a Panda scan on-line, it might work if I downloaded and installed it but, again, I received a message that it isn't compatible with X64. AVG had no option to export/save a report.

I'll run a HJThis and post it.

Thanks for checking out bdscan.

Denise

 

I copied and pasted ver > c:\osver.txt into the run box and just c:\osver.txt. Both ways, I get a message that says that Windows cannot find c:\osver.txt or ver > c:\osver.txt.

 

Microsoft Windows [version 5.2.3790]

 

C:\mg

 

My computer has slowed down to a crawl again. The clean boot did the trick . . . my pc was humming along at first and it slowly got slower and slower until now, when I can't change the name of a file if I'm moving another file.

 

Hi, I ran all the programs. SpyBot S&D is the only program that found something but there were a number of programs that couldn't run.

I also took some screen shots of error messages when I tried to run some of the programs, i.e., Panda, getrunkey, shownew, etc, but no matter how small the .jpg file is, it can't get small enough to meet the size requirements. If you'd like to see them, let me know and I'll attach them to a photo service and give you the url.

- Windows cannot find 'CD'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

- Windows cannot find 'getrunkey.bat'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.

 

GetRunKey and NewFiles

 

bdscan and hijackthis reports

 

I unzipped both zip files, as you can see in the pictures attached to this and the next post.

I said that they didn't run because I received messages that said that they couldn't run.

After I received the messages that the programs wouldn't work, I received a report anyway. Maybe you can explain that to me because I surely don't know why it happened.

 

I had to crop the screenshots because they were too large to post, so I was able to only crop the folder contents and the messages that I received in 2 separate files.

 

If I did something wrong, let me know what it is and I'll do it the correct way. I thought I'd followed the instructions but there were several conflicts between what I needed to do and what I wasn't able to do.

 

This is also something that ran with ShowNew.

 

If there is no malware in my pc, then the logical move would be to see if something is wrong with either my software or hardware. To tell you the truth, I think my mobo got fried when I installed the SATA card. It's hard to say for sure because I had it up and running for less than a week before I installed the card, so I don't know what's typical.

 

In a number of posts I mentioned the fact that the programs wouldn't run because I have X64. You didn't ask me for the exact messages I received and, even though I offered to post the screenshots at a photo site on the web so that you could see the messages that I received, you didn't show interest in seeing them. I complied with everything you asked me to do and I gave you every report that I received. I had no idea whether they were complete or not because I didn't know what to look for. I was surprised that I received a report at all because the messages said that the program isn't compatible with X64. I posted them here because I wanted you to see that I followed the procedures. I didn't post all the messages that I received because ShowNew had approx 30 error messages, as can be seen in the screenshot I attached to a post.

At least I know for sure now that I don't have malware. I would have been surprised if I did because the problem started right after I did a reformat, as I mentioned in a post before I ran the malware programs.

I'll pick up where I left off in the thread I started in the Software forum. Thanks for your help in determining that it's not a malware problem.

 

The things that you mentioned are important for you to know but they're not to me for the simple reason that ShowNew and GetRunKey didn't seem important to you. . . you didn't ask me what the messages said. You can't expect laymen to know what's important to you unless you ask us, especially if it's unrelated to the problems we're having with our computers. That's why we come here . . . for you to tell us, ask us and show us. I'm glad to have helped you out by giving you the file names but the file names meant nothing to me. All I was concerned about was that they didn't run because I have X64. That's what was important to me and that's what's important to most, if not all, laymen. Don't take for granted the depth of our knowledge of computers and programs because that knowledge is more than likely not there. Don't assume that we're giving you the info you need for program modifications. We're just not geared that way. We want to know why our computers aren't working correctly, not why a scan isn't working correctly. I gave you all the information that's pertinent to the problem I'm having with my computer, not the problem with the program not working properly, and you didn't even think to ask me but you expect me to know that I should have told you. Your help is needed and you and others here come down very hard on people, practically calling us idiots. You lambast us for our lack of knowledge of computers and programs. It's just not right.

 

I gave you all the information that it gave me. Word for word.

You asked for more information but didn't give me the information that I needed so that I could provide you with the information that you were looking for. You said, "The other programs were." What other programs? I could give you no response to this. From my point of view, ShowNew and GetRunKey couldn't work. They were the programs. I needed a file for it to run. Where do I get the file? Can I get the file? Is it not available to X64? It must not be because the programs can't run. I then told you that the programs can't run because I have X64 os. I tried to give you a screen shot that would have given you the info that you could have used but the limits for for posting jpeg's at MG are much too small. I offered to post the screenshots at a photo hosting web site and provide you with the link but you didn't respond. You're lack of response to my offer equated to disinterest in what the error message said.

I can understand that what you do can get annoying. When people don't hear what you're saying to them . . . when they don't do what you tell them to do . . . when they don't provide you with the information that you ask them for. But look at it this way. We are all babies regarding computer software and hardware. If you ran a nursery and had toddlers to take care of, you would have to say the same things over and over again. You would have to expect them not to understand what you're saying. You would need to find out what's wrong with them but they can't tell you because they don't know how to speak very well. The babies, on the other hand, hear you speaking to them but they don't quite understand what you're saying. They try to do what you want them to do but they do the wrong thing most of the times because they have no idea what they're doing. They fall down and you pick them up. They fall down again and you pick them up again. They fall down again and you get upset because you're tired of picking them up. It comes with the job . . . it's part of the territory. You may get exasperated but you're talking to a baby who doesn't know why you're upset. The baby did its best and out of sheer annoyance on your part, the baby is left sitting on the floor with no clue as to what happened.

Think how I feel. I spent hours running those scans, preparing the reports, getting screenshots, trying the different things that you suggested, telling you the response that I received, offering to give you more information about it but the offer was ignored, and then you said that I didn't give you the name of the file. I couldn't help it if the computer didn't respond in a manner that would satisfy you. I couldn't help it that MG doesn't allow larger pictures to be uploaded. I couldn't help it that you didn't want to see the screenshots that would have given you the information that would have helped you. I couldn't make you believe that I unzipped the files and tried to run the programs until I posted parts of the screen shots. But now it's all boiled down to the fact that I didn't tell you the names of the files that weren't working for GetRunKey and ShowNew in an X64 os and not that the programs wouldn't run because I have an X64 os. All I can say is, what the :***?

 

You took what I said the wrong way. I know that you offer help without pay. I wanted to make a comparison between those who are very knowledgeable about computers and those who aren't.

 

I just ran another SpyBot S&D scan and it found PokaPoka again. I went into Safe Mode and deleted it. This is the third time that it's come back. I use Windows firewall and Avast. Is there a way that I can one or both of them to not allow this program to enter my computer again?

Also, has anyone had a chance to review the HiJackThis report that I attached?

 

I ran both programs today.

SUPERAntiSpyware found 9 cookies.

WinPFind3U.exe ran and the report is attached. I changed no settings. The settings that you requested were already chosen.

Denise

PS - Thanks for checking the Hijackthis report.

 

EliteBar nor PokaPoka were in Add/Remove Programs. There was a folder in my computer and I deleted it in Safe Mode.

I was told by someone that Windows Firewall for XP Pro X64 was the best firewall for it, so I kept it. If you would recommend a firewall that will give better protection, please give me the name of the program or a URL for it.

In addition, I use Avast for my on-access scanner for my system and my email. SUPERAntiSpyware is still installed in my system. I have to uninstall one of them. Again, if you think there's a better program for my os than Avast, please let me know.

Denise

 

Thanks for checking out the WinPFind report.

I run AdAware, SpyBot S&D, Microsoft Malicious Spyware Removal Program on a weekly basis, and I go to Trend Micro once in a while to have my pc checked out.

If I'm reading you correctly, I need both an anti-virus program and an anti- spyware program running. Would Avast and SuperAntiSpyware be a good on-access combination?

Denise

 

Hi Chaslang,

Poka-Poka showed up in a Spybot S&D search again. You had asked me to

I didn't delete the file and I saved the logs and attached them.

The name of the file that it's located in my computer is C:\Documents and Settings\Administrator\Local Settings\Tem\~setup0\irsetup.exe

I looked around the internet and there are mixed feeling regarding the file, depending upon other circumstances. One site said
http://www.2-spyware.com/file-irsetup-exe.html