Possible Virus,Please help!

Hi Ozzmark,

Welcome to MR.

Here is some information about the program. Looks like a patch for a program to teach programming. If you don't want it, you can try uninstalling it from Add/Remove Programs in Control Panel.

It is not in the Add or Remove programs...I'll keep it but it is not causing any problems?Just seemed odd to me.

It is not in the Add or Remove programs...I'll keep it but it is not causing any problems?Just seemed odd to me.

Yes, it's odd that you don't seem to know anything about it. It sounds like a program used by schools, teachers and students. If you are a student, you most likely need to keep it. More info here. However, I noticed that you've given the file name as turing 4.0.4.exe, whereas the patch is Turing 4.0.4d.exe. Unless it's a typo, it makes me wonder...

Current Patches for Turing 4.0
There are two updates available for Turing. You only require one, depending on which version of Turing you currently own:
Turing 4.0 - 4.0.1 [p] => Turing 4.0.4d update [9,610,195 bytes]
Turing 4.0.3 or higher => Turing 4.0.4d update [2,913,204 bytes]
Both updaters are executable installers that will attempt to find Turing on the hard drive. They will then install the new version of Turing over top of the old version. Please note that Turing must already be installed on the machine.

Can you give me the full path of the file please? Nothing malware related is showing in your log, but let's do an online scan to make sure.

Run an online scan at Panda's ActiveScan

• Please go here and perform a full system scan. (use Internet Explorer)
• Once you are on the Panda site click the Scan your PC button.
• A new window will open...click the big Check Now button.
• Enter your Country.
• Enter your State/Province.
• Enter your Valid Email and click send.
• Select either Home User or Company.
• Click the big Scan Now button.
• If it wants to install an ActiveX component allow it.
• It will start downloading the files it requires for the scan.
• Click on Local Disks to start the scan.
• Once finished, click see report, then click Save report and save it to your desktop.

NOTE: Please ignore any entry it finds and the offer to buy the program to remove the entry.

Post back the results of the Panda scan please.

I am very sorry for not replying with a scan. I am in the process of moving and will have the scan tomorrow.

No worries. Good luck with your moving.

Incident Status Location

Spyware:Cookie/Serving-sys Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Zedo Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.c5.zedo.com/]
Spyware:Cookie/Zedo Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Adserver Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[adserver.filefront.com/]
Spyware:Cookie/RealMedia Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/onestat.com Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[stat.onestat.com/]
Spyware:Cookie/YieldManager Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Falkag Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/YieldManager Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/Falkag Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/Casalemedia Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/WUpd Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.revenue.net/]
Spyware:Cookie/Atwola Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.atwola.com/]
Spyware:Cookie/BurstBeacon Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[www.burstbeacon.com/]
Spyware:Cookie/Com.com Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.com.com/]
Spyware:Cookie/Go Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.go.com/]
Spyware:Cookie/Adrevolver Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/cs.sexcounter Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.cs.sexcounter.com/]
Spyware:Cookie/Statcounter Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Maxserving Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/Xiti Not disinfected G:\Documents and Settings\Mark\Application Data\Mozilla\Firefox\Profiles\cdqa00hw.default\cookies.txt[.xiti.com/]
Potentially unwanted tool:Application/Processor Not disinfected G:\WINDOWS\system32\process.exe


There's the scan,I see a cookie that says sexcounter...This is a porn free computer

There's the scan,I see a cookie that says sexcounter...This is a porn free computer

:lol:
What Panda found were tracking cookies, or small files that store information about what sites you visit online. Advertisers use these for statistical analysis and to target ads that you would be more likely to click on. They're not dangerous in and of themselves, per se, but are definitely a good idea to remove periodically.

Don't confuse them with normal, everyday cookies -- these are used for everything from saving form data to your login information for a particular site.

Here is some reference to cookies (it also tells you how to manage them):

http://www.microsoft.com/info/cookies.mspx

http://support.microsoft.com/default.aspx?scid=kb;en-us;260971

http://www.answers.com/main/ntquery;jsessionid=2pfvcj0v8gsmh?dsid=1512&dekey=cookie+file&sbid=lc03a&linktext=cookie%20file

http://support.microsoft.com/?kbid=260897

Cleaning Cookies in FireFox:

1. In any Firefox window, Click Tools=>Options=>Privacy Icon.
2. Under the Cookies tab, Click Clear Cookies Now button.
3. Click OK to exit Options window.

NOTE: you can set up Firefox to automatically clear cookies and other private data upon exit by clicking Settings button in the Clear Private Data tools section In the Options window:

1. Click Settings button
2. Select the data you would like to clear automatically
3. Place a check mark next to Clear Private Data When Closing Firefox
4. Click OK=>OK to exit the options window

Cleaning cookies in Internet Explorer:

Close all instances of Outlook Express and Internet Explorer

1. Click Start=>Control Panel=>Internet Options
2. In the General tab under the Temporary Internet Files header, Click Delete Cookies
3. Next to it, Click the Delete Files button
4. When prompted, place a check in: Delete all offline content click OK
3. Click OK to exit Internet Options window.

You can use this little free application to help control those tracking cookies in future, if you like. The only problem is that it only works with Internet Explorer as far as I know:

http://www.analogx.com/contents/downloa ... cookie.htm

Alright,I'll clean my cookies. I will also use a program I recieved from you guys awhile ago called ATF Cleaner...

Alright,I'll clean my cookies. I will also use a program I recieved from you guys awhile ago called ATF Cleaner...

Sounds good.

Are you all set with Turing?

If you have no further issues, here is some good reading material from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.org/viewtopic.php?t=957
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Happy Surfing

The turing thing?No. I have never used this program or have never heard of it...It was in my G drive as a .exe sometime.But if it causes no harm then I'm ok with it.

The turing thing?No. I have never used this program or have never heard of it.

Are you the only user on this computer? Are you the original owner of it?

Please give me the exact path of the file so that we can have it checked if it's harmful or not.

This is the file path of HijackThis.exe, for example: G:\HijackThis\HiJackThis.exe

It is G:/turing-4.0.6.

...I double click it and it turns on a command prompt and it closes...

Hi Ozzmark,

I am sorry I missed your reply somehow. Looks like it's an executable update to the Turing program which was possibly installed on the computer earlier.
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste this filepath:
G:/turing-4.0.6.
Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

Thanks

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

That is what that the http://virusscan.jotti.org/ said.