I have an odd task running on my laptop named mUiexec.exe.  HiJackThis lists the 
task as “m?iexec.exe” and the file does not exist in the directory where it points. 
 I am getting a lot of pop-ups.  Any suggestions?

The task loads when IE is loaded.  If I end the task, it comes back the next time 
I load IE.  I also get a recurring "run once" registry entry loading "msdxm.ocx". 
 If I delete it, it comes back.

I included some of the HiJackThis info below, but did not post the whole log because 
the forum would not accept it.

I would appreciate any help with this issue.

Best regards,

Alfie

This is the task:

C:\WINNT\system32\m?iexec.exe

Tip: Run a free scan for common Windows errors ad

re: Ad ware hijacking Thursday, September 16, 2004 at 7:28 pm Posted by pass the salt (4 messages posted) Hi Alfie, You mentioned that you have this entry in your system directory, C:\WINNT\system32\m?iexec.exe, right? restart your system in safe mode. 1) backup your registry go to start > run > type in regedit & click okay. 2) the registry editor would pop up. click on registry > select "export registry file" > Save the registry file with a desired name. 3) After backing up the registry Click on edit, select the find function key in "m?iexec.exe" & search for this entry. Once you come across it rename it from "m?iexec.exe" to "iexec.exe". 4) After doing the above navigate to the C:\WINNT\system32\m?iexec.exe directory & rename this file from "m?iexec.exe" to "iexec.exe". Restart your pc in normal mode & launch your ie again. On Thursday, September 16, 2004 at 5:37 pm, Alfie Mahmoud wrote: >I have an odd task running on my laptop named mUiexec.exe. HiJackThis lists the >task as “m?iexec.exe” and the file does not exist in the directory where it points. > I am getting a lot of pop-ups. Any suggestions? > >The task loads when IE is loaded. If I end the task, it comes back the next time >I load IE. I also get a recurring "run once" registry entry loading "msdxm.ocx". > If I delete it, it comes back. > >I included some of the HiJackThis info below, but did not post the whole log because >the forum would not accept it. > >I would appreciate any help with this issue. > >Best regards, > >Alfie > >This is the task: > >C:\WINNT\system32\m?iexec.exe [Reply or follow-up to this message] re: Ad ware hijacking Thursday, September 16, 2004 at 9:02 pm Posted by DEX (11847 messages posted) Alfie If you are getting popups do this. Download Spybot install it,then run it in Safemode (F8 key to boot) then download Spyware Blaster it keeps them OFF your machine,,It's FREE ------------------------------------------------------------ Spybot from http://www.safer-networking.org/index.php?lang=en&page=download Besure to get the update for Spybot, they update it all the time. http://forums.spywareinfo.com/index.php?showtopic=11150 NOTE******** run Spybot in SafeMode ( F8 key at boot. ) Because Windows will not let any program edit a file that Windows is running. and most Spy/worms/virus,etc. are TSR programs...(load at boot)(but they don't load in safemode) -------------------------------------------------------- Download Ad-aware It's FREE, Download from: http://www.lavasoftusa.com/support/download/#free http://www.lavasoftusa.com/ http://www.lavasoftusa.com/software/adaware/ this is a good one it's like Spybot but finds some more that are hidden..... -------------------------------------------------------- Spyware Blaster.It's FREE, from see below http://www.javacoolsoftware.com/spywareblaster.html if you get a error ( it can't find mscomctl.ocx file download the one below) http://www.spywareinfo.com/forums/index.php?showtopic=6756 On Thursday, September 16, 2004 at 5:37 pm, Alfie Mahmoud wrote: >I have an odd task running on my laptop named mUiexec.exe. HiJackThis lists the >task as “m?iexec.exe” and the file does not exist in the directory where it points. > I am getting a lot of pop-ups. Any suggestions? > >The task loads when IE is loaded. If I end the task, it comes back the next time >I load IE. I also get a recurring "run once" registry entry loading "msdxm.ocx". > If I delete it, it comes back. > >I included some of the HiJackThis info below, but did not post the whole log because >the forum would not accept it. > >I would appreciate any help with this issue. > >Best regards, > >Alfie > >This is the task: > >C:\WINNT\system32\m?iexec.exe [Reply or follow-up to this message] re: Ad ware hijacking Thursday, September 16, 2004 at 9:27 pm Posted by DEX (11847 messages posted) Just a Note about "msdxm.ocx" It's for the Toolbar: & Radio -{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx On Thursday, September 16, 2004 at 9:02 pm, DEX wrote: >Alfie >If you are getting popups do this. >Download Spybot install it,then run it in Safemode (F8 key to boot) >then download Spyware Blaster it keeps them OFF your machine,,It's FREE >------------------------------------------------------------ > >Spybot from http://www.safer-networking.org/index.php?lang=en&page=download >Besure to get the update for Spybot, they update it all the time. >http://forums.spywareinfo.com/index.php?showtopic=11150 >NOTE******** run Spybot in SafeMode ( F8 key at boot. ) >Because Windows will not let any program edit a file that Windows is running. >and most Spy/worms/virus,etc. are TSR programs...(load at boot)(but they don't load >in safemode) >-------------------------------------------------------- >Download >Ad-aware It's FREE, Download from: >http://www.lavasoftusa.com/support/download/#free >http://www.lavasoftusa.com/ >http://www.lavasoftusa.com/software/adaware/ >this is a good one it's like Spybot but finds some more that are hidden..... >-------------------------------------------------------- >Spyware Blaster.It's FREE, from see below >http://www.javacoolsoftware.com/spywareblaster.html > >if you get a error ( it can't find mscomctl.ocx file download the one below) >http://www.spywareinfo.com/forums/index.php?showtopic=6756 > > > [Reply or follow-up to this message] re: Ad ware hijacking Sunday, September 19, 2004 at 1:21 pm Posted by Alfie Mahmoud (2 messages posted) Thanks everyone. I found the file after setting Win2K to display system files. I already had it set to display hidden files, but that was not enough. Once set to display system files, I found the file msiexec.exe and renamed it. The Spyware quit loading and the pop-ups went away. After running it a few days, I deleted the file. The file came from the scum-bags at fastclick.com. I hope this information is also useful for anyone else who gets this problem. Regards, Alfie On Thursday, September 16, 2004 at 9:27 pm, DEX wrote: >Just a Note about >"msdxm.ocx" >It's for the >Toolbar: & Radio -{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx > > > [Reply or follow-up to this message] re: Ad ware hijacking Thursday, November 18, 2004 at 9:19 am Posted by Bob (2 messages posted) Alfie....I have the same problem and did what you had done. The pop ups still exist but a new and strange problem exists. When I search the net it will lock so I can't write any script in search boxs or navigate to another page. Once in a while I'll get an IE error and it will shutdown IE. Any idea? Hows your system working since deletion. I alsloread that the msiexec is a microsoft installer program..... On Sunday, September 19, 2004 at 1:21 pm, Alfie Mahmoud wrote: >Thanks everyone. I found the file after setting Win2K to display system files. >I already had it set to display hidden files, but that was not enough. Once set >to display system files, I found the file msiexec.exe and renamed it. The Spyware >quit loading and the pop-ups went away. After running it a few days, I deleted the >file. The file came from the scum-bags at fastclick.com. > >I hope this information is also useful for anyone else who gets this problem. > >Regards, > >Alfie > > > [Reply or follow-up to this message] Tip: Use one of the [Reply or follow-up to this message] links above to add a message to this thread Search this forum Start a new thread on a different subject Report abuse of the forum Return to the Windows 2000 Discussion Forum