re-hijack this

GunJack

RussJK wrote: »

Also upload this to www.virustotal.com, even though it's usually a legit Realtek file:
C:\Users\joe\AppData\Local\Temp\RtkBtMnt.exe

bit of invest shows that if it's in a temp file, likelyhood is it's dodgy. Could have been legit if in a normal windows location (part of realtek HD sound). Check out

http://www.pcmech.com/forum/networking-online-security/211839-rtkbtmnt-exe.html

joe134

GunJack wrote: »

two things jump out at me on the HJT log - Rapport and spybot's teatimer.

Rapport is junk and well-known for bad interactions with other software, such as....yes, you guessed it, teatimer

Go into spybot and turn off teatimer (advanced mode, resident, untick teatimer) and uninstall rapport, then try again

Hi Gunjack, thanks for info.I,ve done teatimer, BUT, I know the Rapport pros/cons. and have had it ages with no ill effects.+ do lots of internet banking, and prefer to keep it. I know you may /will disagree and tell me, why ask if I don,t take your advice.I can turn it off when downloading etc.If it continues, then I will take it off. Also, I,m lost about Upload. Is it the log, to upload? and are you disagreeing? .never heard of the site, or what it does.:beer:

RussJK

Go to www.virustotal.com, press Browse, then in the dialog copy/paste this line:
C:\Users\joe\AppData\Local\Temp\RtkBtMnt.exe
and press enter.

It should start to upload the file. When it gives a report, give us the URL/link if you can.

Virustotal is a site that has multiple antivirus scanners from various vendors, and allows suspicious files to be checked. Of course you can't rely completely on the results, as there are many reasons for false positives and false negatives.

The file I'm suggesting you upload is suspicious as it's running from a temp folder, even though it might be a legit file left running after an automatic update. There'd be no good recent for Realtek to want it permanently running from a temp folder, but there's no obvious autostart for it either. If it persists after a reboot, I'd be more even more suspicious.

joe134

RussJK wrote: »

Go to www.virustotal.com, press Browse, then in the dialog copy/paste this line:
C:\Users\joe\AppData\Local\Temp\RtkBtMnt.exe
and press enter.

It should start to upload the file. When it gives a report, give us the URL/link if you can.

Virustotal is a site that has multiple antivirus scanners from various vendors, and allows suspicious files to be checked. Of course you can't rely completely on the results, as there are many reasons for false positives and false negatives.

The file I'm suggesting you upload is suspicious as it's running from a temp folder, even though it might be a legit file left running after an automatic update. There'd be no good recent for Realtek to want it permanently running from a temp folder, but there's no obvious autostart for it either. If it persists after a reboot, I'd be more even more suspicious.

I,ve just read the link Gunjack gave bout it.I,ll try and do as you say,hope i,m successful.

joe134

joe134 wrote: »

I,ve just read the link Gunjack gave bout it.I,ll try and do as you say,hope i,m successful.

Sorry Russ, I am a bit lost here,I cannot find BROWSE in the upload a file section, just list of files that doesn,t inclde that one.It,s probably me not doing it right.Where s the BROWSER? on the page

santer_2

When I clicked this link it was below FAQ

http://www.virustotal.com/

You can e-mail them

http://www.virustotal.com/advanced.html#email

GunJack

there's also a lot of carpy services running in there too, like all the acer sw, AOL connectivity, etc. I suggest once you've got it stable visit closed's thread on speeding up a pc, as the less carp running will also help with the overall stability

RussJK

waddler_8

You'll find lots of instances of the legitimate Realtek file RtkBtMnt.exe running from %temp%

http://systemexplorer.net/filereviews.php?fid=42351

http://www.virustotal.com/file-scan/report.html?id=d0d489c248df89f867f028bb4b19af65b3ccfe24e2410010ea8f80b46bf3a9eb-1308412059

joe134

RussJK wrote: »

I don,t get that when I visit. I get,choose file to the left, and no browse at all to the right.I,ve E-mailed them, but thats supposed to be an /or the Attached file, which I cannot find, so just typed it, and sent.