re: belgiandip.com
Sunday, March 21, 2004 at 3:00 pm
Windows XP Annoyances Discussion Forum
Posted by Jay
(1 messages posted)
I just got rid of it today with the help of the guys at lurkhere.com. The files that
caused trouble were: PUP.EXE, GSH400J.EXE and FWD.EXE. I ran McAfee updated 6.0 and
got them. McAfee could not remove FWD.EXE so I did the manual removal goint to Windows/System.
These files were installed on Windows/System, not on Windows/System32. You all should
try to get the program "hijack this" it will scan your system activity and report
on everything you may need to id these type of viruses. Good luck to all.
On Monday, March 15, 2004 at 1:44 pm, Vinny wrote:
>I think I FINALLY fixed it. Using security task manager I found a program running
>called roctexep.exe that looked funny to me. I quarantined it and have opened and
>closed I.E. many many times with no pop-ups. Then I re-booted a few times and did
>the same just to see if would re-materialize from another program I may have missed,
>so far, so good (knock on wood) thanks again for all of your help.
>
>
>
>On Monday, March 15, 2004 at 1:04 pm, Tim wrote:
>>Hmmm... You certainly have a perplexing infestation then. It doesn't make any
>sense
>>that you don't have a file on your machine like we would expect. I'm a bit at
>a
>>loss, but I'll try a couple more suggestions. First, I did see someone say that
>>the latest version, dated yesterday, of Ad-aware will get this. If so, you can
>get
>>it for free at www.lavasoftusa.com. Also, you might want to download and run Hijack
>>This. It won't fix this problem itself, but it might help clean up junk that came
>>along at the same time. I found that when I got this thing, my computer had been
>>directed to a site called achtungachtung (not typing it as a url, for obvious reasons)
>>that downloads a trojan onto your computer. Also, I got directed to something
like
>>default-network-homepage or similar that brought up lots of junk too. I have no
>>idea how my computer got sent to those places in the first place but I suspect
it
>>had something to do with the Windows messenger service before I could disable it.
>> Anyway, my point is you need to check to see it there is more to clean up than
>just
>>the belgiandip problem. This takes virus scanning and registry clean up to fix
>everything.
>> OK, back to your problem at hand.
>>
>>This may be a bit drudgerous and it is a bit risky (not overly so), but what I
personally
>>would do is try to find the program in the task manager that is causing this...
>
>>Bring up the task manager and go to the Processes tab. Go down the list of every
>>process that is running (you can obviously ignore things like SYSTEM, SYSTEM IDLE
>>PROCESS, and svchost.exe and anything else that you are absolutely 100% sure is
>>part of Windows and supposed to be there, but if in doubt, include it in what I'm
>>about to suggest). For each listed process, open a search window and search for
>>the .exe file on your machine. For example, if you wanted to check it anyway,
you'd
>>search for svchost.exe (obviously it will take a little while for your machine
to
>>search for each file, that's the drudgery part). Once you find each file, right
>>click (DON'T double-click) and select Properties. Check out the description field
>>contents and then click the version tab and make sure that the company listed is
>>Microsoft, or someone you know you should be running software from like Symantec,
>>Real Networks, etc. depending on what all you have on your machine. I bet you'll
>>eventually find something that looks suspicious and I even expect you'll find "totempole"
>>in the company field. Anyway, once you find something suspicious, you can try
killing
>>the process and see if your problem goes away. Of course, this is the risky part,
>>if you have chosen badly, you could crash your machine, but this is probably not
>>a high risk, even if you do. Of course, make sure you write that process name
down
>>before you kill it so you can then search for it again and delete it and clean
your
>>registry as we discussed before. Maybe someone else will have a simpler solution,
>>but that's the best I can up with at this point. Good Luck!
>
- Written in response to:
- re: belgiandip.com (Vinny: Monday, March 15, 2004 at 1:44 pm)
There are presently no replies to this message.
|
|
All messages in this thread [show all]
 |  | | | | | | |  | re: belgiandip.com (Jay: Sun, Mar 21, 2004, 3:00 pm) |
| |
| |
| |
Return to the Windows XP Discussion Forum
|
|
