Thanks to one of my kids surfing the Web, my PC now automatically logs into AOL via what appears to be a scheduled program and brings up a rather unsavory website. I'm try to locate the delete the offending program. Could it be RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp? If not, other ideas? Thanks.

[Reply or follow-up to this message]

Controlpanel/Add-Remove Programs.Download Adaware AND SpybotS&D from WWW.WEBATTACK.COM the TOP 100 FREEWARE PAGE.Run them Updated and Offline.READ the Tutorials!


On Thursday, January 29, 2004 at 7:59 am, AKB wrote:
>Thanks to one of my kids surfing the Web, my PC now automatically logs into AOL via
>what appears to be a scheduled program and brings up a rather unsavory website.
>I'm try to locate the delete the offending program. Could it be RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp?
> If not, other ideas? Thanks.

[Reply or follow-up to this message]

Definitely spyware at work.

The "tweakmeup" registry entry you refer to is the "TweakUI" Control Panel applet at work.

Colin

[Reply or follow-up to this message]

AKB 

Virus ,Trojan Horse
Backdoor.Subwoofer allows a hacker to remotely control an infected computer. 

To remove from your machine do this

Click Start, and click Run. The Run dialog box appears. 
Type regedit and then click OK. The Registry Editor opens. 
Navigate to the key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value

Tweak UI          "RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup"

Navigate to the key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

In the right pane, delete the value

Scheduling Agent        "Scheduler.exe"

Click Registry, and click Exit.

Reboot check again to see if it's back in the reg.file..
Now download Spybot from the net install it reboot into safe mode ( F8 key at boot 
up ) run Spybot
Then turn around and tells the kids NO No No please...to much work for dad to fix....but 
love ya you little shits,,
I got 4 of them " rug rats..."
hope this helps

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.subwoofer.html






On Thursday, January 29, 2004 at 7:59 am, AKB wrote:
>Thanks to one of my kids surfing the Web, my PC now automatically logs into AOL 
via 
>what appears to be a scheduled program and brings up a rather unsavory website. 
 
>I'm try to locate the delete the offending program.  Could it be RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp? 
> If not, other ideas?  Thanks.

[Reply or follow-up to this message]

Thanks DEX but it didn't work. I deleted RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup, but no Scheduling Agent resided in the RunServices folder. The virus is still in the system somewhere. I can fool it by renaming my AOL.exe and changing the shortcut, but a permanent fix would be nice.


On Thursday, January 29, 2004 at 8:57 pm, DEX wrote:

>AKB 
>
>Virus ,Trojan Horse
>Backdoor.Subwoofer allows a hacker to remotely control an infected computer. 
>
>To remove from your machine do this
>
>Click Start, and click Run. The Run dialog box appears. 
>Type regedit and then click OK. The Registry Editor opens. 
>Navigate to the key
>
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
>
>In the right pane, delete the value
>
>Tweak UI          "RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup"
>
>Navigate to the key
>
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
>
>In the right pane, delete the value
>
>Scheduling Agent        "Scheduler.exe"
>
>Click Registry, and click Exit.
>
>Reboot check again to see if it's back in the reg.file..
>Now download Spybot from the net install it reboot into safe mode ( F8 key at boot 
>up ) run Spybot
>Then turn around and tells the kids NO No No please...to much work for dad to fix....but 
>love ya you little shits,,
>I got 4 of them " rug rats..."
>hope this helps
>
>http://securityresponse.symantec.com/avcenter/venc/data/backdoor.subwoofer.html
>
>

[Reply or follow-up to this message]

Download CWShredder from the net
It should take it out....can't hurt
http://www.spywareinfo.com/~merijn/downloads.html






On Friday, January 30, 2004 at 3:21 pm, AKB wrote:
>Thanks DEX but it didn't work.  I deleted RunDLL32 tweakUI.DLL, TWEAKUI /tweakmeup, 
>but no Scheduling Agent resided in the RunServices folder.
>
>The virus is still in the system somewhere.  I can fool it by renaming my AOL.exe 
>and changing the shortcut, but a permanent fix would be nice.
>
>

[Reply or follow-up to this message]

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum