Malware Removal Forums

stick bugs

drew · 2010-01-25T06:03:59+00:00

Dad built me a new computer because mine wouldn't turn on, he transferred my old documents/pictures into the new one from my last hard drive. All was great until Dad handed me a thumb drive/stick to put some of my pictures on. I plugged in thumb drive without a thought... A box popped up at bottom right saying something about losing some files. I told Dad what it said, then I put the pictures on the thumb drive/stick, then pulled it out of my computer. At some point probably when I pulled it out, another box popped up saying something else. Dad then took the stick to his computer to transfer pics online to Walgreens for copies to be made. He then RAN the stick in his computer like it was telling him to do to fix this losing file issue it was alerting to. He then came to my computer and RAN the stick again, again doing what it told him to do. A bit later, dad finds some weird "file cure" on his computer. I can't find this "file cure" on mine. Dad scans his computer with comodo, I scan m

114 min read

shinybeast

February 18, 2010, 2:56 AM UTC

Hi drew,

I confused locations for PlusStart.exe.
This is the file that seems suspicious. It was on the C: drive actually.
C:\Driver Install Disk\CD_v3.2NM (H)\Utility\ProMagicPlus\FILES\PlusStart.exe TrojWare.Win32.Trojan.Agent.Gen@5226799 Success

If you didn't install the program, then it probably isn't responsible for the issues. If you were to use the program in the future, I suggest you re-download it from a good source. It appears comodo quarantined it, so delete the C:\Driver Install Disk\CD_v3.2NM (H)\Utility\ProMagicPlus folder if it is still there.

In my add/remove programs is a "Realtek high definition audio driver". It is running in my processes and is it connected to this O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.)?

Yes, ALCMTR.exe is connected to the audio driver but is not necessary to run at startup for it to function. Keep the driver (Realtek high definition audio driver) installed so that your sound works.

I am also wondering why Eset picked up HomePatrol as a problem. Do you think it was a false positive or maybe there is something to it?

It could be a false positive or it could be infected. It is the only thing I see that might be a problem.

We can get a second opinion.

Upload file for scanning

Please visit Jotti's Malware Scan
Click the Browse button near the top of the page.
Copy and paste the file and path below into the File Name box and click Open

C:\Program Files\PC Magazine Utilities\HomePatrol\HomePatrol.exe
Click Submit and wait for the scanning to complete
Bookmark/Add to Favorites the scan page and copy the address/URL in the location bar and paste that URL in your next reply.

Just to sum up there are two issues; the computer wanting to accept an incoming connection (from 66.248.36.36) when online and the printing issue when online.
The computer connects to the internet via dial-up. It is not networked with other computers and just connects to the phone line. Correct?
Please tell me who your internet provider is. Also, what program are you reading/printing emails with when online?

Please include the Jotti link in your next reply along with answers to my questions about the issues.

drew

February 20, 2010, 7:55 AM UTC

Ok, Thank you

C:\Driver Install Disk\ folder is deleted

Looks like Homepatrol is false positive from heuristics scan? It's a web cam program that was put on the computer for me.

http://virusscan.jotti.org/en/scanresult/e96e4b4a0eada4fd846f71285ea3fe8922fd1b21

Three issues -
1. Comodo alerting to an incoming connection (from 66.248.36.36) when downloads are running.
2. In ability to print when in email (possibly online problem)
3. Internet dial up connection running very slowly (at 14-30kb when it should be 50kb)

The computer is connected to dial up by phone line, no network.
Provider is peoplepc and email is peoplepc. I tried printing in both regular screen and from the page made for printing, neither work.

shinybeast

February 20, 2010, 11:07 PM UTC

Hi drew,

I agree, Homepatrol looks like a false positive.

I think that you should allow the connection to 66.248.36.36 and see if that influences the speed of your connection. I found a connection between Paetec and PeoplePC and although not definitive, I think it is safe to allow the connection and see what happens. Then see if that has any affect on the online printing issue.

Also, can you print if you are offline?

drew

February 21, 2010, 1:08 AM UTC

Hi Shinybeast,

Ah interesting. I will call around and ask about that Paetec too.

It prints fine offline from documents within the computer. And it printed emails fine in the beginning before the thumb drive went in.

shinybeast

February 24, 2010, 4:42 PM UTC

Hi drew,

Are you still with us?

Please let me know how things are going otherwise...
After 24 hrs., if you have not replied to this thread... it will be closed!

jmw3

February 26, 2010, 5:41 AM UTC

lack of response,