Hello, I am was wondering if someone could help me determine if there is an infection with my computer. The most recent issue is that I am getting an "C:\WINDOWS\winstart.bat is offline - it is currently not available (42006)" error on two recent Quick Scans using avast! in the past two days. I've run SUPERAntiSpyware (SAS), MBAM, Spybot S&D, MB Anti-rootkit and have found no issues other than tracking cookies. In addition I had tried to install & run Kapersky's free one-time scanner but was unable to install twice due to "insufficient" permissions and once where the installation stopped during the download phase (some message about " server connection"). Note if I look for the winstart.bat file using Windows Explorer it doesn't show the file even with the option of seeing hidden files yet when I run show-hidden -f it shows the file as being hidden in that location (I.e. C:\Windows\winstart.bat). Note that the only virus issues I have had over the past months have been when ComboFix was compromised with Sality: I believe I isolated that issue as AVG, SAS, SpyBot and CCleaner were able to eradicate most (??) of the issues.
In addition, in the past I have had issues with Chrome which were unusual. The first occurrence was during August last year where the Facebook title of a "Most Visited" tile was a name of person I had not visited recently. If I understand the mechanics properly there is a local name of a tile associated with a screenshot capture. Then Chrome will get the title of that URL, from a DNS server (??), after about 15-30 seconds after running and the title will be re-named. Again what was odd was not that the Facebook tile was a title other than "Facebook" it was for a person who I had not visited in some time (months honestly). I inspected the element and saw that the title was this person's name and opened the 'Top Sites' file using SQLite Database Browser and the title of that URL was the person's name. Eventually I uninstalled Chrome and it finally went away. I thought nothing serious of the behavior until it started to happen again recently. But this time not only was the Facebook tile people's names, this time whose pages I had visited, but I was getting strange titles such as 'hero' or 'Ye Jin.' I can say that I have never visited Facebook pages with those names and that I am very careful about clicking on links in Facebook so as to avoid apps and/or viruses. In addition normally if you hover the tile, in the bottom-left corner the associated URL will be displayed: normally for a person's page it would be https://www.facebook.com/FirstName.Lastname but in all of these cases it was for the root URL (i.e. just https://www.facebook.com). Then I continuously got Chrome crashes whenever I closed Chrome and these persisted until I disabled RealPlayer Downloader extension. However, when I visited Chrome's History page I would see that it showed me visiting Facebook pages for people I had not visited: again this is after a full uninstall and after I had cleared the cache and database using CCleaner. Again when hovering over the History URL entry that was named a person, whose page I hadn't visited, it would show the root URL. And lastly, if I visited the history a few minutes later that entry would be gone.
I have begun to use Firefox over the past two weeks so I am unable to say if the issue remains but given the recent avast! issue with winstart.bat I thought I would mention it as odd behavior that may, or may not, be related.
Thanks for any help you can provide.
Edited by hamluis, 28 February 2013 - 11:59 AM.
ignore this box, please...my error - Hamluis.