«

Located it the winnt\system32 folder is randomly generated exe files with 4
and 5 letter names like vlos, xprst, etc... HighJack This was the only thing
that detected it in the registry. Adaware and Spybot did not find it. In the
registry it is called something like 23098a4roo4j@j... Deleting this and it
comes back 3 seconds later. The exe files show as hidden files in the system
folder. It is a pain in the ass to get rid of. I had to delete all 5 exe's
that were listed in the system folder and the registry entry, then kill the
running process and reboot. if you miss 1 file...on reboot the rest come
back. Anyone know which spyware program will detect and kill this. This one
causes pop ups.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
Sharpvision simply the best http://www.seedsv.com

why do you think it's spyware? It can also be a worm, a virus or a
backdoor, a DDoS-bot, an open-relay etc.

Try posting your (full) HijackThis log.


On Sat, 10 Jan 2004 17:48:21 GMT, in
<FVWLb.1609$ t>
pcbutts1 scrawled:

>Located it the winnt\system32 folder is randomly generated exe files with 4
>and 5 letter names like vlos, xprst, etc... HighJack This was the only thing
>that detected it in the registry. Adaware and Spybot did not find it. In the
>registry it is called something like 23098a4roo4j@j... Deleting this and it
>comes back 3 seconds later. The exe files show as hidden files in the system
>folder. It is a pain in the ass to get rid of. I had to delete all 5 exe's
>that were listed in the system folder and the registry entry, then kill the
>running process and reboot. if you miss 1 file...on reboot the rest come
>back. Anyone know which spyware program will detect and kill this. This one
>causes pop ups.

--
Basic computer maintenance
http://uk.geocities.com/personel44/maintenance.html

Well excuse me for my choice of words. It has been corrected.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
Sharpvision simply the best http://www.seedsv.com



"Chiron Paixos" <> wrote in message
news: s.com...
> why do you think it's spyware? It can also be a worm, a virus or a
> backdoor, a DDoS-bot, an open-relay etc.

It is on a users system at work I will post it the next chance I get.

--


The best live web video on the internet http://www.seedsv.com/webdemo.htm
Sharpvision simply the best http://www.seedsv.com



"°Mike°" <> wrote in message
news:...
> Try posting your (full) HijackThis log.
>
>
> On Sat, 10 Jan 2004 17:48:21 GMT, in
> <FVWLb.1609$ t>
> pcbutts1 scrawled:
>
> >Located it the winnt\system32 folder is randomly generated exe files with
4
> >and 5 letter names like vlos, xprst, etc... HighJack This was the only
thing
> >that detected it in the registry. Adaware and Spybot did not find it. In
the
> >registry it is called something like 23098a4roo4j@j... Deleting this and
it
> >comes back 3 seconds later. The exe files show as hidden files in the
system
> >folder. It is a pain in the ass to get rid of. I had to delete all 5
exe's
> >that were listed in the system folder and the registry entry, then kill
the
> >running process and reboot. if you miss 1 file...on reboot the rest come
> >back. Anyone know which spyware program will detect and kill this. This
one
> >causes pop ups.
>
> --
> Basic computer maintenance
> http://uk.geocities.com/personel44/maintenance.html