Beta.exe

Discussion in 'Computer Support' started by Brian H¹©, Jun 30, 2003.

  1. Brian H¹©

    Brian H¹© Guest

    I had a file called beta.exe mess with me earlier, it started out as a *.scr,
    every time I ran Task Manager or Regedit they would open and then close again.
    I renamed the file, rebooted and managed to delete it along with 3 registry
    entries, my AV (eTrust), Ad-Aware and Spybot S&D find nothing else to get rid
    of.

    Now, every few minutes, I find that my synched folders in OE are reset, and if I
    choose to synch accounts everything gets re-downloaded.

    Any ideas as to what/where I should now be looking to clean up what is obviously
    some residue left over from this little bugger?

    TIA
    Brian
     
    Brian H¹©, Jun 30, 2003
    #1
    1. Advertising

  2. Brian H¹©

    °Mike° Guest

    Online Antivirus scanners:
    --------------------------
    http://housecall.antivirus.com/
    http://www.pandasoftware.es/activescan/activescan-com.asp
    http://commandondemand.com/eval/index.cfm
    http://security2.norton.com/us/home.asp

    Anti-virus programs:
    --------------------
    eZ Antivirus (Computer Associates)
    http://www.my-etrust.com/products/Antivirus.cfm

    Vet (Computer Associates)
    http://www.vet.com.au/html/products/index.html

    Sophos
    http://www.sophos.com/products/software/antivirus/

    Gladiator
    http://www.gladiator-antivirus.com/

    F-Prot
    http://www.f-prot.com/download/

    AVG
    http://www.grisoft.com/


    Anti-trojan:
    ------------
    Trojan Defence Suite
    http://tds.diamondcs.com.au/

    Trojan Hunter
    http://www.misec.net/trojanhunter.jsp

    Trojan Remover
    http://www.simplysup.com/

    Tauscan
    http://www.agnitum.com/products/tauscan/


    Anti-spyware:
    ---------------------
    Spybot Search & Destroy
    http://security.kolla.de/

    Ad-Aware
    http://www.lavasoftusa.com/

    Spyware Blaster
    http://www.wilderssecurity.net/spywareblaster.html

    HijackThis
    http://www.tomcoyote.org/hjt/


    Control your startups:
    ---------------------------------
    StartupList
    http://www.lurkhere.com/~nicefiles/

    Startup Monitor
    http://www.mlin.net/StartupMonitor.shtml

    Check what's necessary and what isn't
    http://www.pacs-portal.co.uk/startup_pages/startup_all.php
    http://www.3feetunder.com/krick/startup/list.html
    http://www.greatis.com/regrun3startupprograms.htm
    http://www.greatis.com/regrun3appdatabase.htm
    http://www.greatis.com/regrun3necessary.htm


    Basic system maintenance:
    http://uk.geocities.com/personel44/maintenance.html


    On Mon, 30 Jun 2003 18:55:12 +0100, in
    <1Q_La.164$>
    Brian H¹© scrawled:

    >I had a file called beta.exe mess with me earlier, it started out as a *.scr,
    >every time I ran Task Manager or Regedit they would open and then close again.
    >I renamed the file, rebooted and managed to delete it along with 3 registry
    >entries, my AV (eTrust), Ad-Aware and Spybot S&D find nothing else to get rid
    >of.
    >
    >Now, every few minutes, I find that my synched folders in OE are reset, and if I
    >choose to synch accounts everything gets re-downloaded.
    >
    >Any ideas as to what/where I should now be looking to clean up what is obviously
    >some residue left over from this little bugger?
    >
    >TIA
    >Brian
    >


    --
    STGP, OGPE24HSHD
     
    °Mike°, Jun 30, 2003
    #2
    1. Advertising

  3. Brian H¹©

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... °Mike° said:

    (snip)

    As a regular, Mike, I'm aware of the links you posted.
    And as I said, nothing is being picked up by AV, Ad-Aware *or* Spybot S&D.
    Every time I open OE, my folders are reset and synching reloads everything
    instead of just the newest messages.

    >
    >
    > On Mon, 30 Jun 2003 18:55:12 +0100, in
    > <1Q_La.164$>
    > Brian H¹© scrawled:
    >
    >> I had a file called beta.exe mess with me earlier, it started out as a *.scr,
    >> every time I ran Task Manager or Regedit they would open and then close
    >> again. I renamed the file, rebooted and managed to delete it along with 3
    >> registry entries, my AV (eTrust), Ad-Aware and Spybot S&D find nothing else
    >> to get rid of.
    >>
    >> Now, every few minutes, I find that my synched folders in OE are reset, and
    >> if I choose to synch accounts everything gets re-downloaded.
    >>
    >> Any ideas as to what/where I should now be looking to clean up what is
    >> obviously some residue left over from this little bugger?
    >>
    >> TIA
    >> Brian
     
    Brian H¹©, Jun 30, 2003
    #3
  4. Brian H¹©

    °Mike° Guest

    On Mon, 30 Jun 2003 19:38:29 +0100, in
    <Ds%La.228$>
    Brian H¹© scrawled:

    >X-No-Archive: Yes
    > Errrrr...erm... °Mike° said:
    >
    >(snip)
    >
    >As a regular, Mike, I'm aware of the links you posted.
    >And as I said, nothing is being picked up by AV, Ad-Aware
    >*or* Spybot S&D. Every time I open OE, my folders are reset
    >and synching reloads everything instead of just the newest
    >messages.


    Sorry, Brian, I didn't even look at your name - I was busy
    doing something else at the same time, and just posted the
    standard links... :-/

    Select the group/s and right-click / 'Synchronization settings'.
    You'll see the options.

    <snip>

    --
    STGP, OGPE24HSHD
     
    °Mike°, Jun 30, 2003
    #4
  5. Brian H¹©

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... °Mike° said:

    > On Mon, 30 Jun 2003 19:38:29 +0100, in
    > <Ds%La.228$>
    > Brian H¹© scrawled:
    >
    >> X-No-Archive: Yes
    >> Errrrr...erm... °Mike° said:
    >>
    >> (snip)
    >>
    >> As a regular, Mike, I'm aware of the links you posted.
    >> And as I said, nothing is being picked up by AV, Ad-Aware
    >> *or* Spybot S&D. Every time I open OE, my folders are reset
    >> and synching reloads everything instead of just the newest
    >> messages.

    >
    > Sorry, Brian, I didn't even look at your name - I was busy
    > doing something else at the same time, and just posted the
    > standard links... :-/
    >
    > Select the group/s and right-click / 'Synchronization settings'.
    > You'll see the options.
    >
    > <snip>


    That's not my problem, every time I start OE, and after about every 5 minutes
    once opened, something seems to be clearing the cache and if I click synch, all
    message bodies get downloaded again.
    This has only been happening since I had this damned file run on my system.
    I haven't changed my OE settings at all from what they are usually set at.
    It's not really a big deal re-downloading the bodies, but I would like to find
    out what is causing this to happen.
     
    Brian H¹©, Jun 30, 2003
    #5
  6. Brian H¹©

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... Richard said:

    > "Brian H¹©" <> wrote in message
    > news:1Q_La.164$...
    >> I had a file called beta.exe mess with me earlier, it started out as a *.scr,
    >> every time I ran Task Manager or Regedit they would open and then close
    >> again. I renamed the file, rebooted and managed to delete it along with 3
    >> registry entries, my AV (eTrust), Ad-Aware and Spybot S&D find nothing else
    >> to get rid of.
    >>
    >> Now, every few minutes, I find that my synched folders in OE are reset, and
    >> if I choose to synch accounts everything gets re-downloaded.
    >>
    >> Any ideas as to what/where I should now be looking to clean up what is
    >> obviously some residue left over from this little bugger?
    >>
    >> TIA
    >> Brian
    >>

    >
    > http://www.sophos.com/virusinfo/analyses/w32kwbote.html


    taken from sophos' site
    W32/KWBot-E copies itself to the Windows system folder as XMW32.EXE and creates
    the folder <Windows>\sCache32. W32/KWBot-E then

    Did you spot that the file I am talking about is called beta.exe and not
    xmw32.exe?

    >
    > http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_XMS.A&V
    > Sect=T
    >
    > look for a folder called \scache32 and the same in the registry.



    taken from trendmicro
    "Upon execution, this worm drops a copy of itself named XMS32.EXE in the Windows
    system directory"

    Again, the file I am talking about is called beta.exe
     
    Brian H¹©, Jun 30, 2003
    #6
  7. Brian H¹©

    °Mike° Guest

    On Mon, 30 Jun 2003 19:56:16 +0100, in
    <jJ%La.248$>
    Brian H¹© scrawled:

    <snip>

    >>That's not my problem, every time I start OE, and after

    >about every 5 minutes once opened, something seems to be
    >clearing the cache and if I click synch, all message bodies
    >get downloaded again. This has only been happening since I
    >had this damned file run on my system. I haven't changed my
    >OE settings at all from what they are usually set at. It's
    >not really a big deal re-downloading the bodies, but I would
    >like to find out what is causing this to happen.


    I'd get a second opinion, if I were you. Just because your
    AV and AAW/SB doesn't report anything, doesn't mean you're
    clean.

    Use StartupList
    http://www.lurkhere.com/~nicefiles/

    and HijackThis
    http://www.tomcoyote.org/hjt/


    Startup Monitor is also a great 'alerter' for anything that
    tries to register itself to run at startup - for the future.
    http://www.mlin.net/StartupMonitor.shtml

    --
    STGP, OGPE24HSHD
     
    °Mike°, Jun 30, 2003
    #7
  8. Brian H¹©

    Richard Guest

    "Brian H¹©" <> wrote in message
    news:EM%La.252$...
    > X-No-Archive: Yes
    > Errrrr...erm... Richard said:
    >
    > > "Brian H¹©" <> wrote in message
    > > news:1Q_La.164$...
    > >> I had a file called beta.exe mess with me earlier, it started out as a

    *.scr,
    > >> every time I ran Task Manager or Regedit they would open and then close
    > >> again. I renamed the file, rebooted and managed to delete it along with

    3
    > >> registry entries, my AV (eTrust), Ad-Aware and Spybot S&D find nothing

    else
    > >> to get rid of.
    > >>
    > >> Now, every few minutes, I find that my synched folders in OE are reset,

    and
    > >> if I choose to synch accounts everything gets re-downloaded.
    > >>
    > >> Any ideas as to what/where I should now be looking to clean up what is
    > >> obviously some residue left over from this little bugger?
    > >>
    > >> TIA
    > >> Brian
    > >>

    > >
    > > http://www.sophos.com/virusinfo/analyses/w32kwbote.html

    >
    > taken from sophos' site
    > W32/KWBot-E copies itself to the Windows system folder as XMW32.EXE and

    creates
    > the folder <Windows>\sCache32. W32/KWBot-E then
    >
    > Did you spot that the file I am talking about is called beta.exe and not
    > xmw32.exe?
    >


    Did you bother to read the page and note the fact that it was discussing the
    beta.exe file?
    of course not. from now on, DYOFDW.
     
    Richard, Jul 1, 2003
    #8
  9. Brian H¹©

    Brian H¹© Guest

    X-No-Archive: Yes
    Errrrr...erm... Richard said:

    > "Brian H¹©" <> wrote in message
    > news:EM%La.252$...
    >> X-No-Archive: Yes
    >> Errrrr...erm... Richard said:
    >>
    >>> "Brian H¹©" <> wrote in message
    >>> news:1Q_La.164$...
    >>>> I had a file called beta.exe mess with me earlier, it started out as a
    >>>> *.scr, every time I ran Task Manager or Regedit they would open and then
    >>>> close again. I renamed the file, rebooted and managed to delete it along
    >>>> with 3 registry entries, my AV (eTrust), Ad-Aware and Spybot S&D find
    >>>> nothing else to get rid of.
    >>>>
    >>>> Now, every few minutes, I find that my synched folders in OE are reset, and
    >>>> if I choose to synch accounts everything gets re-downloaded.
    >>>>
    >>>> Any ideas as to what/where I should now be looking to clean up what is
    >>>> obviously some residue left over from this little bugger?
    >>>>
    >>>> TIA
    >>>> Brian
    >>>>
    >>>
    >>> http://www.sophos.com/virusinfo/analyses/w32kwbote.html

    >>
    >> taken from sophos' site
    >> W32/KWBot-E copies itself to the Windows system folder as XMW32.EXE and
    >> creates the folder <Windows>\sCache32. W32/KWBot-E then
    >>
    >> Did you spot that the file I am talking about is called beta.exe and not
    >> xmw32.exe?
    >>

    >
    > Did you bother to read the page and note the fact that it was discussing the
    > beta.exe file?
    > of course not. from now on, DYOFDW.


    Do you know the difference between something renaming *from* beta.exe and
    renaming *to* beta.exe ?

    I didn't ask you to do my dirty work for me, I didn't ask *you* to do *anything*
    for me.
     
    Brian H¹©, Jul 1, 2003
    #9
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Romila

    Beta 70-298 Beta Exam

    Romila, Sep 6, 2003, in forum: MCSE
    Replies:
    1
    Views:
    629
    MCSE World
    Sep 8, 2003
  2. =?Utf-8?B?bWlrZSBvJ3I=?=

    IE7 beta causes x64 computer to shut down(lsaaa.exe)

    =?Utf-8?B?bWlrZSBvJ3I=?=, May 5, 2006, in forum: Windows 64bit
    Replies:
    1
    Views:
    557
    Alexis
    May 6, 2006
  3. =?Utf-8?B?U3F1aXp6?=

    ntoskrnl.exe error with Vista Beta 2 install

    =?Utf-8?B?U3F1aXp6?=, Jun 13, 2006, in forum: Windows 64bit
    Replies:
    3
    Views:
    356
    =?Utf-8?B?SkVKRUpF?=
    Jun 13, 2006
  4. Luke Duke
    Replies:
    63
    Views:
    1,893
    POD {Ò¿Ó}
    Jan 11, 2008
  5. troutman
    Replies:
    10
    Views:
    2,223
    troutman
    Dec 21, 2008
Loading...

Share This Page