[techmoron]

Hi,

I was downloading google talk, and my comodo firewall in the beginning gave a pop up message that google was a safe and recognized application and that I could allow that to connect to my computer. However, when the google talk was almost complete i got a pop up from comodo saying that a UNRECOGNIZED PARENT GOOGLE.EXE application was detected and asked if I wanted to allow or block. Before i could think of what to do, google talk was already installed. So, i went to control panel and tried to remove google talk from there, but when I clicked on remove i got another message from comodo saying that clicking remove is going to allow some heuristic application or something like that which is not safe..so, i checked block request on comodo.
I rebooted the computer, google talk pops up first...so the application is running. I tried to remove it from control panel again, i can't, it says its probably already removed, but i can see google talk in the control panel. Also, the icon exists on my desk top. I shift deleted the Icon from desktop, but can't get rid of the google talk itself. it pops up on my computer everytime i start my computer, its gets started even before my other regular messengers like msn start up.
Is my computer infected?

[TOGG]

If the program still has an entry in your Add/Remove list, Revo Uninstaller should be able to get rid of it for you; http://www.revouninstaller.com/

If you decide to try this, be sure to read ALL the instructions carefully. It operates at several levels of removal, from simply trying to use the unwanted program's own uninstaller to a really thorough scan and removal of every last part of the program, including Registry stuff.

I normally use the 'Safe' level which does include some Registry modifications but isn't a problem as long as you only allow the bolded items to be removed. Revo creates a Restore Point before it starts, but you still need to take the time to read the details carefully.

[techmoron]

Thanks. I'll get rid of it but before that I want to know "is my computer infected?"

[TOGG]

I assume you have run scans with whichever antivirus or other security programs that you have?

If such scans were not conclusive, you could get second opinions from some online scanners. There is a 'sticky' thread in the 'Malware Removal & HJT logs' forum which gives details of various Security tools, including online scanners. This is one of them; http://www.eset.eu/eset-online-scanner

[techmoron]

yes, i did a malwarebyte scan and also posted in the malware board. Thanks for your help.

[TOGG]

In future, when you install new programs, it might be an idea to go offline and then disable Comodo Defense+ (if you have it enabled) because it will object to every file the new program attempts to install, producing some alarming messages while it does so (at least it does for me).

I have tried switching to 'Installation Mode' but it didn't seem to make any difference. I'm using version 3.8.65951.477 with the firewall and Defense+ set to 'Safe Mode'. I know there is a newer version of CIS but, because it comes with the antivirus and BOClean, it's a 72MB download which is a bit much for my dialup connection, especially as I don't need the antivirus.

I gather the d/l is so large because it includes a major antivirus definitions update which won't happen again, so I'll probably get the next update to the firewall when it comes out.

[Pranav]

Originally Posted by TOGG

In future, when you install new programs, it might be an idea to go offline and then disable Comodo Defense+ (if you have it enabled) because it will object to every file the new program attempts to install, producing some alarming messages while it does so (at least it does for me).

I have tried switching to 'Installation Mode' but it didn't seem to make any difference. I'm using version 3.8.65951.477 with the firewall and Defense+ set to 'Safe Mode'. I know there is a newer version of CIS but, because it comes with the antivirus and BOClean, it's a 72MB download which is a bit much for my dialup connection, especially as I don't need the antivirus.

I gather the d/l is so large because it includes a major antivirus definitions update which won't happen again, so I'll probably get the next update to the firewall when it comes out.

Comodo AntiVirus and BOClean aren't up to the mark yet. The only worthy product that Comodo has come out with is its firewall. And it sure makes up for the antivirus and BOclean lag.

[TOGG]

I certainly won't be ditching NOD32 for Comodo's AV any time soon!

I was quite happy running BOClean when it was standalone (even though it was never clear to me how much good it was doing) but I don't want it enough to tolerate the Comodo AV to get it.