win.com

[QUALTHWAR]

My daughter is having problems with her PC and I’m wondering if it might be from a virus. She has Spybot installed and if a program tries to make a change to the registry, it will alert the user and ask them if they want to allow the change or not.

Today, she gets this message from spybot popping up about win.com. It just kept coming back so I told it to deny the change and to remember the decision. Now, you see a constant message from spybot at the edge of the monitor, letting you know it is denying this change. Whatever it is, it’s relentless. Something just keeps trying to make a change to win.com.

I went to trendmicro and searched for viruses, but it found nothing. I updated spybot and did a search for spyware, but nothing. I’m checking it now with Norton, but I suspect that it will find nothing.

She was trying to send a webcam pic of my grandson the other day to a friend of hers with yahoo messenger and that wasn’t working. The person said they got a message that the webcam was unavailable. So, I’m wondering if it might have something to do with her webcam.

But here’s the other thing I’m wondering about: What if she has a virus trying to install, but I’m keeping it from installing by denying it to overwrite the win.com file? If so, the virus programs might not find anything because the virus hasn’t really installed itself yet. The virus might just keep at it, but is constantly being denied by spybot.

Any ideas? The spybot messages are constantly on the side now saying it’s denying the change. It’s a pain. But if it’s really a virus trying to write and I tell it ok, then she will get a virus. I’ve checked into the programs that are running with task manager, and they all seem like legitimate programs.

 

[Btljuice]

Winpatrol

Swatit

Grab those ans run them. You can turn Winpatrol off via msconfig later and then run it as needed. It's great for killing spy/ad/malware. Swatit is a great trojan/bot hunter/killer. Both are free.

 

[QUALTHWAR]

okay, thanks, i'll check into it. i think before i do all that, i'm going to uninstall her webcam software and see if that has something to do with it.

 

[Rukee]

^ along with those, try to boot to safe mode with networking and from the admin account perform your scans, try the Housecall, Panda, BitDefender, Symantec, Macafee online anti virus scan tools while in safe mode. Each seems to chatch things the others don`t, so run them all, and any others you can find too. If they all give you a clean bill of health, you should be good to go. :tup:

 

[QUALTHWAR]

I’ve tried 2 of those. Housecall is trendmicro (I call them antivirus.com) and tried Norton.

But like I said, what if a virus got onto her PC? It tries to install itself but is blocked from installing because spybot won’t let it write to the registry. At this point, it’s not really a virus yet because it has done nothing to the PC. Then you scan for a virus, but it can’t find anything because the virus scan is looking for changes made by the virus, but the virus is halted from making those changes.

Let’s say this is what’s going on. Then I allow the change to the registry, the virus installs itself, and now the antivirus scans will see it because of the changes it made when it installed. I need to be sure this isn’t going to happen before I allow the change to the registry.

 

[QUALTHWAR]

whatever is was, i got it fixed. i used system restore to get rid of it. i still wonder if it might have been a virus trying to install, but since it couldn't, system restore still worked.

 

[VeNN]

"ghost in the machine"