Problem with Malicious script and a possibly invalid directory.

  • Thread starter Thread starter Grape
  • Start date Start date
G

Grape

I will try to avoid making this sound complicated.

I have a persistent problem with a malicious script that my AntiVirus
somehow let in. It effects my TCP/IP and slows my connection to a
crawl. I dread to think what it might be going to end up doing.

Despite deleting the offending file, {HELPCTR.EXE-OB5B31B} It always
returns.

It is in a sub directory of Windows called Prefetch. Is this a
legitimate directory? Can I delete the entire directory?

Tech support at my AntiVirus site is, shall we say, inadequate, so I
am pretty much on my own.

Any feedback whatever that anyone might provide would be greatly
appreciated

Thanks

Grape Crusher
 
I will try to avoid making this sound complicated.

I have a persistent problem with a malicious script that my AntiVirus
somehow let in. It effects my TCP/IP and slows my connection to a
crawl. I dread to think what it might be going to end up doing.

Despite deleting the offending file, {HELPCTR.EXE-OB5B31B} It always
returns.

It is in a sub directory of Windows called Prefetch. Is this a
legitimate directory? Can I delete the entire directory?

Tech support at my AntiVirus site is, shall we say, inadequate, so I
am pretty much on my own.

Any feedback whatever that anyone might provide would be greatly
appreciated

Thanks

Grape Crusher

The 'prefetch' folder is a valid Windows folder, it acts as a kind of cache
of regularly used programs
I have deleted the folder in the past (it's contents anyway), I believe that
if deleted, it will be recreated again on next reboot, thus re-starting it's
cache of the reguarly used programs (parts/data).

Suggest that you download and use the first two of below, before attacking
the 'prefetch' folder
One or both may solve the problem;
Ad-Aware
http://www.lavasoftusa.com/

Spybot-S&D
http://www.safer-networking.org/

SpywareBlaster (this prog prevents baddies from installing in the first
place)
http://www.javacoolsoftware.com/spywareblaster.html
 
The 'prefetch' folder is a valid Windows folder, it acts as a kind of cache
of regularly used programs
I have deleted the folder in the past (it's contents anyway), I believe that
if deleted, it will be recreated again on next reboot, thus re-starting it's
cache of the reguarly used programs (parts/data).

Suggest that you download and use the first two of below, before attacking
the 'prefetch' folder
One or both may solve the problem;
Ad-Aware
http://www.lavasoftusa.com/

Spybot-S&D
http://www.safer-networking.org/

SpywareBlaster (this prog prevents baddies from installing in the first
place)
http://www.javacoolsoftware.com/spywareblaster.html

First, thank you so much for taking the time to respond.

(It is probably obvious from my descriptions that I am most definitely
NOT a technically adept person.)

Second, I left something out of the filename of the offending script.
It is HELPCTR.EXE-OB5B31B.PF. I left off the .PF in my original post.

I am afraid however that I must somehow get to the root of the
problem, and I don't know where to start. I fear that something more
is going to go wrong. I doubt that the invading code is intended to
only slow down my dial-up connection.

Deleting the contents of the folder seem unlikely to work. If the
Prefetch folder does recreate itself, would it not then include the
offending script file? Since I keep deleting the malicious file, and
it keeps regenenrating, it clearly seems to be created by some unknown
application or other invader.

Since I do not know what invading application caused this, the app
cannot be removed. I have religiously used NAV and kept it updated
reqularly, and it did not prevent this. And I have just used a free
scan from the home page of PC-Cillin, which the Microsoft support page
directed me to. It offers a "house call" online scan that is free.
That scan too tells me that I have no viruses.

(BTW, if anybody is interested, Norton offers NO SUPPORT on a two year
old version of NAV, and support in removing a virus in current
versions is $29.95 per incident! outrageous!!)

I also use SpyBot as reqularly as I do NAV, and whatever it finds,
which is very little, I delete. The most recent scan, today, found 4
Ad Bots which I deletedFairly typical. I rebooted. The problem
remains..

I tried AdAware some time ago: I do not remember specifically, but I
do recall that it caused some problems and I uninstalled it.

I have even thought of backing up, reformatting, and re-installing but
that seems way too drastic, and probably would not work anyhow.
Firstly WinXP Home does not even HAVE backup. Second, if I use a third
party back-up, would I not likely include the offending code in what
is backed up?

So I am still stumped. I've somehow got this THING and I don't know
what generated it, nor how to fix it. And dreading what might come
next. Seems to me the invader intends to do more than simply slow down
my dial-up connection.

I realize I have gone on and on, but my frustration level is at flood
crest. I am feeling truly desperate. Any additional comments would be
gratefully received.

Grape Crusher
 
First, thank you so much for taking the time to respond.

(It is probably obvious from my descriptions that I am most definitely
NOT a technically adept person.)

Me niether, I was just hopeing for a quick solution.
Second, I left something out of the filename of the offending script.
It is HELPCTR.EXE-OB5B31B.PF. I left off the .PF in my original post.

All files (except layout.ini) in that directory are *.pf
I am afraid however that I must somehow get to the root of the
problem, and I don't know where to start. I fear that something more
is going to go wrong. I doubt that the invading code is intended to
only slow down my dial-up connection.

Do you (by the way) have a firewall installed, even XP's firewall would be
better than nothing.
I use ZoneAlarm (free version), which can be downloaded from;
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp

Deleting the contents of the folder seem unlikely to work. If the
Prefetch folder does recreate itself, would it not then include the
offending script file? Since I keep deleting the malicious file, and
it keeps regenenrating, it clearly seems to be created by some unknown
application or other invader.

I have file "HELPCTR.EXE-3862B6F5.pf", I deleted it (to recycle bin).
When I rebooted, it was not there, when I opened 'Help and Support' the file
recreated itself.
Thus, as expected, the file was created/altered by 'Help and Support'
i.e. it aught not to recreate unless you use H&S
BTW are thiere any other files thiere of same name (different
HEXnumber-string)
Since I do not know what invading application caused this, the app
cannot be removed. I have religiously used NAV and kept it updated
reqularly, and it did not prevent this. And I have just used a free
scan from the home page of PC-Cillin, which the Microsoft support page
directed me to. It offers a "house call" online scan that is free.
That scan too tells me that I have no viruses.

So what is it that makes you believe the particular file is a problem ?

(BTW, if anybody is interested, Norton offers NO SUPPORT on a two year
old version of NAV, and support in removing a virus in current
versions is $29.95 per incident! outrageous!!)

Why waste money/time on Norton, I have heard that it is but 'bloatware' and
is no better than anything else.

I use the free version of AntiVirus-Grisoft (AVG);
http://www.grisoft.com/us/us_dwnl_free.php
You'll need to give them a valid e-mail address so that they can send (5-10
min) you an activation code.
I also use SpyBot as reqularly as I do NAV, and whatever it finds,
which is very little, I delete. The most recent scan, today, found 4
Ad Bots which I deletedFairly typical. I rebooted. The problem
remains..

I tried AdAware some time ago: I do not remember specifically, but I
do recall that it caused some problems and I uninstalled it.

Ad-Aware is a top-class program,
If it caused you trouble then it is most likely a symptom of a problem
elsewhere.
(What particular problem occurred with it ?)
I have even thought of backing up, reformatting, and re-installing but
that seems way too drastic, and probably would not work anyhow.
Firstly WinXP Home does not even HAVE backup. Second, if I use a third
party back-up, would I not likely include the offending code in what
is backed up?

As you say, you might just be backing up the problem !
So I am still stumped. I've somehow got this THING and I don't know
what generated it, nor how to fix it. And dreading what might come
next. Seems to me the invader intends to do more than simply slow down
my dial-up connection.

I realize I have gone on and on, but my frustration level is at flood
crest. I am feeling truly desperate. Any additional comments would be
gratefully received.

Grape Crusher

Anyways, sorry I can't think of how else to help, hopefully someone else
will have a better idea !
 
Me niether, I was just hopeing for a quick solution.
Still, I appreciate the feedback.
All files (except layout.ini) in that directory are *.pf
yeah, but I felt the need to be complete.
Do you (by the way) have a firewall installed, even XP's firewall would be
better than nothing.
I use ZoneAlarm (free version), which can be downloaded from;
http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp

I use the XP Firewall. Since I have only a dial-up connection I felt
that was sufficient. Perhaps when (IF!)I get the problem fixed I will
get ZoneAlarm.
I have file "HELPCTR.EXE-3862B6F5.pf", I deleted it (to recycle bin).
When I rebooted, it was not there, when I opened 'Help and Support' the file
recreated itself.
Thus, as expected, the file was created/altered by 'Help and Support'
i.e. it aught not to recreate unless you use H&S
BTW are thiere any other files thiere of same name (different
HEXnumber-string)
No, the only file starting with HELPCTR is the one I mentioned above.
Notice there is a difference in the string from your file.

And it does re-create as soon as I either re-boot, or use the dialer.
So what is it that makes you believe the particular file is a problem ?

I should have gone into this when I started, but was afraid it sounded
too complicated.

I have a dial up connection. Usually have really good kps, Over 50.
Considered a very good line. All of a sudden a few days ago, I got
disconnected. When I reconnected, it was only at 33.6. I figured it
was a momentary glitch. It wasn't. Kept getting connected at this
lower speed. And the sounds the modem was making were very unusual.
Called tech support at my ISP. To make a long story short, I finally
did the Modem Diagnostics built into Win XP home edition. About 8
steps into it I get a Red Framed warning that there is a malicious
script, HelpCtr.exe, and reccomends that I block it. I do. It does not
good.

I searched for the file name. Got 4 hits. The other three appear to be
legitimate parts of the Windows Help system, properties say origin is
Microsoft, dates are at least 18 months ago. They are simply
HELPCTR.EXE. no further string.

And if I try to delete those files I get a warning that it might make
my system unstable. So I figure it must be the other one, the one with
the string.
Why waste money/time on Norton, I have heard that it is but 'bloatware' and
is no better than anything else.

Ive used Norton for years without a problem. But based on the lack of
support I will switch to something else once this is fixed. My version
is only 2 years old and they offer no support for it!

I used an online free scan from the company that makes PC-Cillin. It
found nothing. But I just realized that I probably should have
disabled norton before doing that scan.
I use the free version of AntiVirus-Grisoft (AVG);
http://www.grisoft.com/us/us_dwnl_free.php
You'll need to give them a valid e-mail address so that they can send (5-10
min) you an activation code.

I will check it out. But I am not making changes until I figure this
out.
Ad-Aware is a top-class program,
If it caused you trouble then it is most likely a symptom of a problem
elsewhere.
(What particular problem occurred with it ?)

I honestly do not remember. Between the popup controls in Netscape,
(Yes Netscape!) and the very fine capabilities of SpyBot I felt
pretty well protected. I also use Mailwasher to rid myself of spam.
Excellent, at least for my limited use. It prefilters, and bounces
objectionable stuff, and REMEMBERS. It's blacklisting fuction really
works!

But again, I digress.
As you say, you might just be backing up the problem !

If I cannot come up with some way to get rid of this, I think the only
thing to do is to reformat and start from scratch, which I DEFINITELY
do not want to do. I can copy important files to CD, but that would
take days and about 30 discs! And I can't figure out how to salvage my
stored eMails that have registration numners and other transaction
records. I guesss I will just have to print them out.

Anyways, sorry I can't think of how else to help, hopefully someone else
will have a better idea !

Just your interest has been an encouragement. And no one else seems to
have taken notice....even posted to a couple of NAV groups and
....nothing...Nada.

So , thanks again, and if you think of anything else based on my
responses, I'd be glad to hear from you.

Grape Crushe.
 
Still, I appreciate the feedback.

yeah, but I felt the need to be complete.


I use the XP Firewall. Since I have only a dial-up connection I felt
that was sufficient. Perhaps when (IF!)I get the problem fixed I will
get ZoneAlarm.
No, the only file starting with HELPCTR is the one I mentioned above.
Notice there is a difference in the string from your file.

And it does re-create as soon as I either re-boot, or use the dialer.

I should have gone into this when I started, but was afraid it sounded
too complicated.

I have a dial up connection. Usually have really good kps, Over 50.
Considered a very good line. All of a sudden a few days ago, I got
disconnected. When I reconnected, it was only at 33.6. I figured it
was a momentary glitch. It wasn't. Kept getting connected at this
lower speed. And the sounds the modem was making were very unusual.
Called tech support at my ISP. To make a long story short, I finally
did the Modem Diagnostics built into Win XP home edition. About 8
steps into it I get a Red Framed warning that there is a malicious
script, HelpCtr.exe, and reccomends that I block it. I do. It does not
good.

I searched for the file name. Got 4 hits. The other three appear to be
legitimate parts of the Windows Help system, properties say origin is
Microsoft, dates are at least 18 months ago. They are simply
HELPCTR.EXE. no further string.

And if I try to delete those files I get a warning that it might make
my system unstable. So I figure it must be the other one, the one with
the string.


Ive used Norton for years without a problem. But based on the lack of
support I will switch to something else once this is fixed. My version
is only 2 years old and they offer no support for it!

I used an online free scan from the company that makes PC-Cillin. It
found nothing. But I just realized that I probably should have
disabled norton before doing that scan.


I will check it out. But I am not making changes until I figure this
out.


I honestly do not remember. Between the popup controls in Netscape,
(Yes Netscape!) and the very fine capabilities of SpyBot I felt
pretty well protected. I also use Mailwasher to rid myself of spam.
Excellent, at least for my limited use. It prefilters, and bounces
objectionable stuff, and REMEMBERS. It's blacklisting fuction really
works!

But again, I digress.


If I cannot come up with some way to get rid of this, I think the only
thing to do is to reformat and start from scratch, which I DEFINITELY
do not want to do. I can copy important files to CD, but that would
take days and about 30 discs! And I can't figure out how to salvage my
stored eMails that have registration numners and other transaction
records. I guesss I will just have to print them out.



Just your interest has been an encouragement. And no one else seems to
have taken notice....even posted to a couple of NAV groups and
...nothing...Nada.

So , thanks again, and if you think of anything else based on my
responses, I'd be glad to hear from you.

Grape Crushe.

:) (One of my cats is makeing competion with the PC for my attention, just
stands in front of the Monitor) :)
Anyways;

I've been searching on Google;
http://tinyurl.com/2lumd

I saw _this_ thread there, and the post that you made to the Norton-Group
(no reply)
Said post to Norton-Group was a little more concise (but no reply)

The general consensus as to the matter, seems to be, that NAV is to blame.

Heres a link that gives a thread that gives a reply by an MVP that blames it
on to NAV200
http://tinyurl.com/23xa9

Anyway, I'll post this and get back to scouring on Google (another page of
three to go).
 
[snipped]
Just your interest has been an encouragement. And no one else seems to
have taken notice....even posted to a couple of NAV groups and
...nothing...Nada.

So , thanks again, and if you think of anything else based on my
responses, I'd be glad to hear from you.

Grape Crushe.

Might this Symantec page be of any help?

"What to do when Script Blocking alerts on a script"
http://tinyurl.com/2zevn
 
[snipped]
Just your interest has been an encouragement. And no one else seems to
have taken notice....even posted to a couple of NAV groups and
...nothing...Nada.

So , thanks again, and if you think of anything else based on my
responses, I'd be glad to hear from you.

Grape Crushe.

Might this Symantec page be of any help?

"What to do when Script Blocking alerts on a script"
http://tinyurl.com/2zevn
"What to do when Script Blocking alerts on a script"
http://tinyurl.com/2zevn

(This is the second time I am posting this. SOMEHOW it got
mis-addressed! Ithink my Malicous script is starting to do some
damage.)...

Actually, script blocking DID NOT alert. I would not have discovered
this unless I had done the Modem Troubleshooter. It is only within
this that the alert came. I would have continued to assume that the
slow down of my dialup connection was my ISP's fault.!

Well, you are certainly more resourceful than I am. I would not have
thought to search google.

Unfortunately none of the links provided lead to a solution.
Particularly perplexing is one of the NAV "solutions" which outlines a
way to manually quarantine the offending file in order to submit it to
them for analysis. Attempting to do so results in an error because
the file is in use by another program! Well, DUH! (and they would not
have accepted my submission anyway. see below)

I am especially incensed at NAV. First they take my money for a
subscription renewal without informing me that my version (only two
years old!) is no longer eligible for tech support! Had I known that,
it is possible I might have purchased the new version. However, it
also develops that "incident assistance" is charged for: $29.95 per
incident. And there is NO free support for ridding oneself of an
infection. Only support available is for generic installation use of
the program. and NO live support of any kind is available

Ok, I have vented!

And something new has been added. Everytime I restart or power down
and then boot up I get the generic message from Microsoft that my
"system has recovered from a serious error...etc." and asks me to
submit the report. But no error has been encountered. No blue screen,
nada. Every time I submit this report I get a very generic response
that a driver is at fault, but they cannot determine exactly which. I
have had this response many times over the nearly three years I have
had this computer. But always after a Blue Screen of death. This is
not the case now.

I am coming closer to the point of reformating and starting over.
Which will involve DAYS. At minimum I will have many hours on Windows
Update bringing the OS up to the present day, to say nothing of
installing and configuring all my apps,

If you, or anyone reading this knows how to save or backup eMails, I
would appreciate that feedback. I know I can save them as txt
files,but that would lose a variety of links embedded in some
important emails that contain registrations etc.

As far as other Anti Virus programs are concerned, the one you pointed
me to does not seem to scan for Trojans or Worms, and does not seem to
automatically repair/quarantine. I saw a bunch of links telling how to
manually repair a whole bunch of stuff, but nothing about how it deals
with problems automatically, and nothing about how updating
definitions is managed. Granted, it was nearly 2 AM and I was like the
walking dead so perhaps I misread.... so if you have any input I'd
appreciate it.

And based on the reviews I can find on ZDNet I am considering
PC-Cillin. Need more investigating.

I don't know whether to cry, break something or go into permanent
hibernation!

Thanks again. Looking forward to your comments.

Grape Crusher
 
Grape Crusher wrote:

[snipped] a lot, I'll try to have look at rest tomorrow !
If you, or anyone reading this knows how to save or backup eMails, I
would appreciate that feedback. I know I can save them as txt
files,but that would lose a variety of links embedded in some
important emails that contain registrations etc.

In Outlook Express to save a single e-mail, I would highlight it, goto
'File' menu and click 'Save As'.
Here there would be option to save-as *.txt or *.eml
Thus I would save the email as *.eml and it would be read/opened with OE
(keeping header info, etc.).
However I suspect that you are not useing OE (your header says 'Forte
Agent), but I should think that another e-mail client would be much the
same.

There are various free OE backup program at below link, but as said they are
for Outlook Express;
http://www.oehelp.com/oebackup/default.aspx

As far as other Anti Virus programs are concerned, the one you pointed
me to does not seem to scan for Trojans or Worms, and does not seem to
automatically repair/quarantine. I saw a bunch of links telling how to
manually repair a whole bunch of stuff, but nothing about how it deals
with problems automatically, and nothing about how updating
definitions is managed. Granted, it was nearly 2 AM and I was like the
walking dead so perhaps I misread.... so if you have any input I'd
appreciate it.

A free online trojan-scan, very easy to use, options to 'prompt for repair'
or 'auto repair' etc.;
http://www.trojanscan.com/

Another free online scan, various options (trojan-scan, Quick Scan, Stealth
Scan etc.);
http://scan.sygatetech.com/prestealthscan.html

Trend Micro free online-scan;
http://housecall.trendmicro.com/

Does single file (<1mb) free online-scan
http://www.kaspersky.com/remoteviruschk.html
 
Something that should have been thought of first is;
Have you tried to use 'System Restore' to restore the machine to a time/date
before the original problem occured ?
 
Snippppp
However I suspect that you are not useing OE (your header says 'Forte
Agent), but I should think that another e-mail client would be much the
same.

For newsgroups, especially for binaries, Agent is the only way to go.

You are correct. I am a Netscape user (YES! I said Netscape!!!!) :)
(I think I have some kind of allergy to Microsoft. Gawd it is
everywhere....And Netscape was the first really good browser, and in
my opinion still better than Explorer. Certainly better cookie and
popup control. Especially cookies. Can control down tothe individual
cookie.)

I will explore possibilites regarding email another time.

I am nearing exhaustion.

So far only a connection slow down. And a couple of other little
oddities. Which I guess I can live with for a while before doing
anything drastic. I need a break......:)

I posted to the microsoft security groups and the response I got was
that the "malicious script" isnt. Just a false alarm. Not a clue as to
what else might be causing my problems

Snipsnipsnip
A free online trojan-scan, very easy to use, options to 'prompt for repair'
or 'auto repair' etc.;
http://www.trojanscan.com/

Another free online scan, various options (trojan-scan, Quick Scan, Stealth
Scan etc.);
http://scan.sygatetech.com/prestealthscan.html

Trend Micro free online-scan;
http://housecall.trendmicro.com/
Did this one. Nothing detected. But it occiurs to me that I probably
should have disabled NAV before starting it...hmmmmm?
Does single file (<1mb) free online-scan
http://www.kaspersky.com/remoteviruschk.html
I really appreciate these links, and will likely check them out a bit
later. Haven't really rested in almost 3 days. Slept, but not rested,
if you know what I mean.

If you are anything at all in person like you are online, you are a
great person to have as a friend.

Thank you so much

Grape Crusher
 
Something that should have been thought of first is;
Have you tried to use 'System Restore' to restore the machine to a time/date
before the original problem occured ?
Oh sure. Did that right away. Tried 3 different dates. No change.

see my other responses in your other post......
 
Snipped
Did this one. Nothing detected. But it occiurs to me that I probably
should have disabled NAV before starting it...hmmmmm?

I've done all these now, all negative, and have come to the
inescapable conclusion that the "malicious script" is a false
positive, which is NOT the cause of my problem. It's just an
unfortunate misleading clue that has misdirected my search for a
solution.

So, I am left with a sudden and very significant reduction in
connection speed, and not a clue what to do. Dell tech support
recommends re-installation. That seems to be their only answer to any
problem posed to them.

If you (or anyone else) has a suggestion, or can point toward another
group or other resource that might deal with this connection problem,
I'd be grateful.

Thanks once more

Grape Crusher
 
Hi Grape Crusher,

Before you format, try to uninstall the modem, reboot and let Windows
detect and install the corresponding modem. (If you know the brand),
or use the drivers of the original installation. This could help to
achieve the speed the modem used to have.
If you, or anyone reading this knows how to save or backup eMails, I
would appreciate that feedback. I know I can save them as txt
files,but that would lose a variety of links embedded in some
important emails that contain registrations etc.

Try to backup the 'My Documents' folder and your *.pst files (or other
e-mail files) to another partition/hard drive/CD using Automated
System recovery. You'll need the Windows XP CD for this.

Go to Start > 'Help and assistance' and type 'Automatic System
recovery' and read the information provided.

If you're committed to a reinstall, this could help you preserve your
settings.

Good luck, hope this helps.
 
Thank you for the feedback

Hi Grape Crusher,

Before you format, try to uninstall the modem, reboot and let Windows
detect and install the corresponding modem. (If you know the brand),
or use the drivers of the original installation. This could help to
achieve the speed the modem used to have.
I did re-install original drivers. No change.
Then installed new updated drivers from Dell. No change.
Try to backup the 'My Documents' folder

Just a little aside...I do not use the "my documents" folder, or ANY
of the pre assigned folders in XP. Call me stubborn. I do my filing MY
WAY! Besides, it makes it too easy for an invader to find stuff:)
and your *.pst files (or other
e-mail files) to another partition/hard drive/CD using Automated
System recovery. You'll need the Windows XP CD for this.
This is news to me. Will definitely check it out. I have only just
found out how to install XP Backup!
Go to Start > 'Help and assistance' and type 'Automatic System
recovery' and read the information provided.

If you're committed to a reinstall, this could help you preserve your
settings.

I am definitely NOT committed to it. Am doing my best to avoid it.
Even if it goes well, the amount of work, and time involved is
daunting. And I really cannot believe that the OS needs
re-installation.

(My ISP has promised to do some troubleshooting at their end, and the
phone company ran some tests, and checked repair and installation
records on my line. Nothing there should be involved. )

For a couple of days more I will just plod along looking for other
avenues of repair. Will re-install only as a very last resort.
Good luck, hope this helps.

I appreciate the good wishes as much as the feedback.

Thank you

Grape Crusher
 
Back
Top