My computer fan runs loud all the time

[SuperDave]

Please go to Jotti's malware scan
(If more than one file needs scanned they must be done separately and logs posted for each one)

* Copy the file path in the below Code box:

Code: [Select]

C:\WINDOWS\pacificService.exe
* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.

[familyfun]

Did I already send this back to you?  Scary that I can't remember! Sorry, here are the results again if you already got them...

File size:   400384 bytes
Filetype:   PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5:   242d3b0c1e483a5d7c6fca57fa9e1698
SHA1:   d8cc1422d73496d02c1379a63c2da033e0c255b 4

http://virusscan.jotti.org/en/scanresult/68ad293161ca8c56638dc3c835bce8a6a9efb7b9

[SuperDave]

Did I already send this back to you?  Scary that I can't remember!

You're correct. This infection is driving me around the bend. We're going to try something else.

Click Start, Search, select All Files and Folders. Copy and paste

Code: [Select]

C:\WINDOWS\pacificService.exe and click search. When you find this file, right-click on it and rename it to pacificService2.exe

If this file is necesary, we then can get it back. If not, we will delete it later. I don't want to delete it until I'm sure it's not used for something. If you get a message that you can't rename it, go to "Safe mode" and then rename it.

Here's how to get into Safe Mode.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

Folder::
c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Wildtangent
c:\windows\wt

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tiger"=-


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

[familyfun]

Ok.  I renamed the file and ran the combofix.  There were actually 2 files that come up when you search:
pacificservice.exe which is 391 kb  and also
PACIFICSERVICE.EXE-062AA009.pf
which is located in windows\Prefetch and is 9kb.  Don't know if that's important but they are both there.  I renamed both with a 2.

Here is the log.  Hopefully this "challenge" is fun and not too much of a pain...
I do really appreciate all your help!!

[Saving space, attachment deleted by admin]

[SuperDave]

Internet Explorer's security is based upon a set of zones. Each zone has different security in terms of what scripts and applications can be run from a site that is in that zone. There is a security zone called the Trusted Zone. This zone has the lowest security and allows scripts and applications from sites in this zone to run without your knowledge. It is therefore a popular setting for malware sites to use so that future infections can be easily done on your computer without your knowledge as these sites will be in the Trusted Zone. Therefore, I recommend that nothing be allowed in the trusted zone. If you agree, please do the following.

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

Trusted Zone: chase.com\www
Trusted Zone: evenue.net\pleasehold
Trusted Zone: fortunerep.com\www
Trusted Zone: gamespot.com\www
Trusted Zone: militaryhistoryonline.com\www
Trusted Zone: mlb.com\arizona.diamondbacks
Trusted Zone: yahoo.com\login
Trusted Zone: yahoo.com\sports

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.

ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the <<Back button then click Finish.

In your next reply please include the ESET Online Scan Log

[familyfun]

OK.  I did the HijackThis scan and of the 8 choices to check mark, the first six were there, so I check marked them and ran the fix.  Then I ran the ESET scan and it came back with 6 infected files; and then it looked like they were cleaned.  I've attached the report from ESET. 
Just to note... the P: drive is an external hard drive where I store photos and videos.  There were 2 infected files on this drive in a "Windows OneCare Backup" folder that for some strange reason is on the P: drive.  There is an empty folder in Programs called Windows OneCare Backup, (no files or folders in it), suggesting that some how those files got moved to the external hard drive (and I have no clue on that one).  So... is this OneCare Backup important? Or can I get rid of it? Or is it useful to me and I didn't even know it?
And thank you again!  You are doing a terrific job!!

[Saving space, attachment deleted by admin]

[SuperDave]

"Windows OneCare Backup" is a product of MicroSoft and somehow was installed on your computer and was probably set to run the backup to your external drive. Do you have it on your computer? Here's some information about OneCare Backup.

[familyfun]

The Windows OneCare Backup shows up under start / programs, but it is empty; and it does not show up on my add or remove programs list.  Another actual OneCare folder, full of files and folders, mostly zip files, is on my external hard drive.  Should I move it off my external hard drive and put it back under programs on my computer?  Or?  And if it had 2 infected files, does that mean it has been backing up my files?  Or can the program itself have infected files??  Sorry, this area is unfamiliar to me... 

And I'm not quite sure why I have OneCare /or where I got it...  Thanks for your help and any recommendations / suggestions!!!

[SuperDave]

Windows OneCare was MS's attempt at an Anti-Virus program which then evolved into MicroSoft Security Essentials. I think they have given up on updates for OneCare. If you don't need it, then you should uninstall it and also delete it from your external drive. Here's a free backup program I found on Bleeping Computer so I know that it's safe:
According to this link it may be still available to existing subscriptions.

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

Folder::
c:\documents and settings\brocks kool lil sis\Local Settings\Application Data\Wildtangent


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze

It looks like renaming those two pacificservice files did the trick. If your computer is running well without them, go ahead and delete them. You may have to do it in "Safe Mode"

[familyfun]

OK, I deleted the 2 pacificservice files and nothing crashed so I'm looking good and you are doing a great job!!
I ran the repair and attached the report for you.  Quick question... the link for the free backup program from Bleeping Computers wouldn't work for me, could you send it again when you get a chance.
Thanks so much!!!!!

[Saving space, attachment deleted by admin]

[SuperDave]

Your log looks good. If there are no other issues, it's time for some cleanup. You can uninstall HJT & ESET but you can keep SAS and MBAM. Update them and run them about once a week depending on your internet activity.

Here's the correct link for the backup.

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /uninstall in the runbox
* Make sure there's a space between Combofix and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
----------------------------------------------------------------------------------------------

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
----------------------------------------------------------------------------------------------------
Looking over your log it seems you don't have any evidence of a third party firewall.

Firewalls protect against hackers and malicious intruders. You need to download a free firewall from one of these reliable vendors.

Remember only install ONE firewall

1) Comodo Personal Firewall (Uncheck during installation "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage" and uncheck any HopSurf and/or Ask.com options if you choose this one)
2) Online Armor
3) Agnitum Outpost
4) PC Tools Firewall Plus

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
-----------------------------------------------------------------------------------------
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smooth.
Safe Surfing!

[familyfun]

First off thank you again for all your help!!!  The computer is doing much, much better!!  I just have a couple of last questions...  when I try to uninstall HJT is tells me that it will remove HiJackThis settings from the registry and exit but that I will have to delete the HiJackThis.exe file manually.  Are those files actually the sniper.exe files?  And can I just delete them?  Or how do I do it manually?

Also, the Windows OneCare Backup is on the P:\ drive (external).  It will not let me delete it.  This is the message.  DO_NOT_DELETE.globalCatalog: Access is denied.  Make sure the disk it not full or write protected and that the file is not currently in use.  Any ideas on how to be able to delete this file? I would like to get rid of it.

Thanks again!!!

[SuperDave]

when I try to uninstall HJT is tells me that it will remove HiJackThis settings from the registry and exit but that I will have to delete the HiJackThis.exe file manually.  Are those files actually the sniper.exe files?  And can I just delete them?  Or how do I do it manually?

Proceed with the uninstall then go to C:\Program Files, Trend Micro and delete this folder.

Also, the Windows OneCare Backup is on the P:\ drive (external).  It will not let me delete it.  This is the message.  DO_NOT_DELETE.globalCatalog: Access is denied.  Make sure the disk it not full or write protected and that the file is not currently in use.  Any ideas on how to be able to delete this file? I would like to get rid of it.

You can try deleting it in "Safe Mode" or you can download Unlocker, install it and then delete it again. Unlocker will kick in and you should be able to delete it now.

[familyfun]

Where do I go to find the Trend Micro folder?  If I search, I get over 500 results with C:\Program Files, Trend Micro... 
Thanks!!

[familyfun]

OK, sorry.  One more thing...  I ran the Secuna scan and got a list of updates needed and did that fine except the Adobe Reader 8.x update gets an error about half way through the install (Error 1402, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OtionalComponants\MSFS)
The bigger thing is I got this list of missing things from Microsoft, but when I open the update window and click on the express or the custom update it checks my computer and then I get  an error:
The website has encountered a problem and cannot display the page you are trying to view. The options provided below might help you solve the problem.
The error is 0x80240030 error. And it gives you 2 solutions to try, which I didn't have luck on either of them.  Is this a problem with my computer or microsoft and can I fix it?  Any suggestions would be great!!!
Thanks!!