Odd file on desktop (_NT.)

[will824]

The file _NT. appeared on my desktop in the last week. There is another thread that relates to this but the scenario is different.

The file looks like diagnostic info with each line including CMyPostMix::

The only changes to my system have been some play with FaceBook add-ons (Vampires - how sad!) and the installation of iTunes.

Any thoughts out there?

 

[howard_hopkinso]

Go and read this thread HERE and post a HJT log as an attachment into this thread.

Regards Howard

This thread is for the use of will824 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[will824]

HJT log attached as requested

Hi Howard,

Here is the HJT log file.

Thanks,
Will

 

[howard_hopkinso]

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O16 - DPF: {326A7290-FAE3-48C5-9FBA-F071633E1EB5} (VPlayer Control) - http://www.flashbeer.com.au/player/vivid_ocx.jpeg

O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Itim-Huntingdon

O17 - HKLM\Software\..\Telephony: DomainName = Itim-Huntingdon
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Itim-Huntingdon

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = itim-huntingdon

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = itim-huntingdon

Fix the above 017 entries if you don`t recognise the domain.

Click on the fix checked button.

Close HJT.

Download the DelinvFile utility and see if you can delete the file on your desktop.

Reboot your system and let us know the results.

Edit: Forgot to include link for DelinvFile utility. Fixed now.

Regards Howard

This thread is for the use of will824 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[will824]

Removal / prevention of desktop file _NT.

Thanks Howard,

It is difficult to judge whether carrying out these actions will stop any reappearance of the file as I had previously deleted it with explorer.

Anyway I will just monitor to see if it reappears.

Will

 

[will824]

Reappearance of file _NT. on the desktop

I now know what is creating this file on my desktop. I use DFX sound enhancer. When I listen to the BBC online it uses the DFX for RealNetworks DLL which contains the text written to the file. I have reported this to the producers of this software. NB it does not get created by DFX for Media Player.

 

[howard_hopkinso]

Thanks for you feedback, it`s very much appreciated.

Regards Howard

This thread is for the use of will824 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.