Computing.Net > Forums > Security and Virus > Weird problem – Please Help

Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free!

Weird problem – Please Help

Reply to Message Icon

Original Message
Name: cachemony
Date: August 10, 2006 at 10:03:35 Pacific
Subject: Weird problem – Please Help
OS: Win XP
CPU/Ram: Dell
Model/Manufacturer: Dimension
Comment:

My Dell 8400 computer is randomly deleting files. They are usually some or all of the files on my desktop, but it recently began deleting any file I save to My Documents and now other areas of the computer, even my start menu. I scanned and scanned for viruses with Norton System Works, but it has not found anything ever.

Now here is the weirdest part: We have two of these Dells in the office and after not being able to fix the problem, I switched and began using the other Dell. With this other computer I used the wireless network card from the first computer, transferred my Thunderbird email back file (which I scanned for viruses) and use the same network and access point. Other than that I was now using a totally different computer. Well, guess what. When I turned on the computer yesterday all the files on the desktop were gone. Today, even more files are gone. The only thing that was the same on the computers were my Thunderbird backup email and the same network card?!?! I am totally lost as to how to figure out what is going on here? Both computers keep deleting files almost randomly….I have no idea what’s going on?

Please Help

Thanks so much,

Noah


Report Offensive Message For Removal


Response Number 1
Name: murr
Date: August 10, 2006 at 10:36:33 Pacific
Reply: (edit)

cachemony

There is malware capable of doing this.Run this free online scan from Panda This scan also does removal.Once finished, save the 'Panda' log and if any infections are still present, post the log here.


Report Offensive Follow Up For Removal

Response Number 2
Name: cachemony
Date: August 10, 2006 at 11:42:56 Pacific
Reply: (edit)

OK here are the log files from the panda scan: No virus, only spyware.


Incident Status Location

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[servedby.advertising.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.overture.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.casalemedia.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.findwhat.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.qksrv.net/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.adrevolver.com/]
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[ad.yieldmanager.com/]
Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[www.myaffiliateprogram.com/]
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.go.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.ehg-dig.hitbox.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.apmebf.com/]
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.bravenet.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.as-us.falkag.net/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.azjmp.com/]
Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[c.enhance.com/]
Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.as-eu.falkag.net/]
Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.ct.360i.com/]
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.xiti.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.247realmedia.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.bs.serving-sys.com/]
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.peel.com/]
Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.tradedoubler.com/]
Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[counter.hitslink.com/]
Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.bfast.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.com.com/]
Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Joe Blow\Application Data\Mozilla\Firefox\Profiles\5m6ooxz6.default\cookies.txt[.valueclick.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@2o7[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@adultfriendfinder[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@advertising[1].txt
Spyware:Cookie/Adviva Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@adviva[1].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@apmebf[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@atdmt[2].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@atwola[1].txt
Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@bluestreak[1].txt
Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@bravenet[2].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@burstnet[2].txt
Spyware:Cookie/Clickbank Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@clickbank[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@doubleclick[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@mediaplex[2].txt
Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@qksrv[2].txt
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@questionmarket[2].txt
Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@revenue[1].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Joe Blow\Cookies\joe blow@statcounter[2].txt


Report Offensive Follow Up For Removal

Response Number 3
Name: murr
Date: August 10, 2006 at 13:13:54 Pacific
Reply: (edit)

Download Ewido then set it up This Way You will need this later in safe mode
Make sure to update this program.

Download ATF-Cleaner to your desktop from
Here You will need it later in safe mode.

Reboot your computer in Safe Mode by doing the following.

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose whichever account that you normally use.

Please make sure ALL security programs including 'Spybot' are disabled until they are needed.

Open Ewido and once you select 'Scanner', and under 'Settings', make sure all the boxes are checked under 'Possibly Unwanted Software.

Run Ewido and delete what it finds.

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Reboot into normal windows and then run this free online Dianogsic scan from Kaspersky

Click Accept
When the updates are finished downloading, click Next, Scan Settings
Under Scan using the following antivirus database:, select extended
Make sure the Scan Archives and Scan Mail Bases options are selected as well. Click OK
Click My Computer and wait for the scan to finish
Click Save Report As. Under Save as type:, select Text file. Save this log to your Desktop.If any infections remain, post a copy of the Kaspersky log here.


Report Offensive Follow Up For Removal







Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Security and Virus Forum Home








Do you have your own blog?

Yes
No
I did before
I will soon


View Results

Poll Finishes In 4 Days.
Discuss in The Lounge
Poll History




Data Recovery Software