Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Error every hour on the hour.


  • Please log in to reply
2 replies to this topic

#1 DVaD

DVaD

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:06:08 PM

Posted 08 November 2010 - 10:16 AM

Hi all, a while ago domain got infected by the Conficker virus. We had removed it using the "Microsoft Malicious Software Removal Tool" and installing 4 updates.
KB957095, KB957097, KB958644, and KB958687 were the updates we used. We also used VIPRE as our anti-virus, which at the time didn't stop the virus. It did help slow it down and remove it from time to time, but it never really stopped the virus. Anyway, the virus has been removed and our network is clean, at least so it would seem. Ever since then there has been an error noise every hour on the hour. Some people have it starting at 9AM some people 10AM.

I've been looking around for some kind of fix for this, but as of yet have only found a few things that didn't fix the issue. I also noticed we were getting some errors from the NAPAgent service, which is odd since we never used network access protection. I hoped that disabling it would stop the error sound, but unfortunately it didn't. If anyone else has this issue or has any ideas on how to fix this any help would be very much appreciated.


I suppose I should mention that there are no errors in event viewer on the hour pretty much any hour that could be correlated with this issue.

Additional update, I went through the sounds to see what sound it was. The sound occurring is the one for the default critical stop sound.

Edited by DVaD, 08 November 2010 - 11:35 AM.
Moved from XP to Am I Infected ~ Hamluis.


BC AdBot (Login to Remove)

 


#2 DVaD

DVaD
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:06:08 PM

Posted 08 November 2010 - 12:12 PM

After doing a little further research in this I found another person had the same issue.

http://www.bleepingcomputer.com/forums/topic195931.html

Mine was similar, but had different names for the files listed to run. The scheduled names had the naming convention of at# # of course being the number of the schedule. After about 6 computers I've seen as many as 16 schedules existing. They make a task for each hour of every day if possible. It looks as though mine only got to make 4 before it got shutdown by AV. Their post says that it was caused by the Virtumonde infection, but I believe mine was caused by Conficker, although there is the possibility that Conficker also brought Virtumonde too. Removing these tasks does seemt o have worked. Does anyone know of a way to remove tasks from multiple PCs in a domain environment? I also have access to SCCM if that makes any difference. I am currently looking around and will post again if I find anything. Otherwise any help would be appreciated.

#3 DVaD

DVaD
  • Topic Starter

  • Members
  • 59 posts
  • OFFLINE
  •  
  • Local time:06:08 PM

Posted 08 November 2010 - 12:48 PM

Ok so another update. I've created a batch file to remove all tasks named at#.job in the folder %windir%\tasks so I'll end up deploying that at some point this week when ever I decide the right time is. If anyone has a better way of removing these tasks let me know.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users