What is file 67412966.exe-Spyware?

Discussion in 'Computer Support' started by Adi, Oct 20, 2004.

  1. Adi

    Adi Guest

    Hi, experts!

    I found in startup of MSConfig configuration file value 67412966 and path
    C:\Windows\System32\67412966.exe as startup file.

    But in that directory I didn't found that file. I make all directories and
    files visible.

    Under Startup group in MSConfig I uncheck box behind it.

    After that I search in Registry and I found it (67412966.exe) and remove it
    from Registry all values and restart computer.

    After new restart all was on old places and wasn't deleted.

    After that with System Mechanic I clean registry again and System Mechanic
    recognize that value as bad, but after complet

    cleaning Registry and restart computer it was been still there.

    On Internet I put for search only number 67412966 and I get 3 pages of
    extension xxx\gov with exactly that number

    and full other numbers,and I suspect for Spyware.

    Some program recognize this value, but not remove it.

    What file could be this, I am very shure thats no belong to Windoes XP.

     
    Adi, Oct 20, 2004
    #1
    1. Advertising

  2. Adi

    Parko Guest

    Adi wrote:

    > Hi, experts!
    >
    > I found in startup of MSConfig configuration file value 67412966 and path
    > C:\Windows\System32\67412966.exe as startup file.
    >
    > But in that directory I didn't found that file. I make all directories and
    > files visible.
    >
    > Under Startup group in MSConfig I uncheck box behind it.
    >
    > After that I search in Registry and I found it (67412966.exe) and remove it
    > from Registry all values and restart computer.
    >
    > After new restart all was on old places and wasn't deleted.
    >
    > After that with System Mechanic I clean registry again and System Mechanic
    > recognize that value as bad, but after complet
    >
    > cleaning Registry and restart computer it was been still there.
    >
    > On Internet I put for search only number 67412966 and I get 3 pages of
    > extension xxx\gov with exactly that number
    >
    > and full other numbers,and I suspect for Spyware.
    >
    > Some program recognize this value, but not remove it.
    >
    > What file could be this, I am very shure thats no belong to Windoes XP.
    >
    >
    >
    >
    >
    >

    It's a System file. Leave it alone and stop being so paranoid.

    --
    Parko
    Registered Linux User #339345
     
    Parko, Oct 20, 2004
    #2
    1. Advertising

  3. Adi

    treehugger Guest

    "Adi" <> wrote in message news:ulsdd.4568$...
    > Hi, experts!
    >
    > I found in startup of MSConfig configuration file value 67412966 and path
    > C:\Windows\System32\67412966.exe as startup file.
    >
    > But in that directory I didn't found that file. I make all directories and
    > files visible.
    >
    > Under Startup group in MSConfig I uncheck box behind it.
    >
    > After that I search in Registry and I found it (67412966.exe) and remove it
    > from Registry all values and restart computer.
    >
    > After new restart all was on old places and wasn't deleted.
    >
    > After that with System Mechanic I clean registry again and System Mechanic
    > recognize that value as bad, but after complet
    >
    > cleaning Registry and restart computer it was been still there.
    >
    > On Internet I put for search only number 67412966 and I get 3 pages of
    > extension xxx\gov with exactly that number
    >
    > and full other numbers,and I suspect for Spyware.
    >
    > Some program recognize this value, but not remove it.
    >
    > What file could be this, I am very shure thats no belong to Windoes XP.
    >
    >
    >


    It certainly does not belong to WinXP. Download "Hijack This" to help you analyze where it's lurking. It's likely that it will have dropped new, differently named .exe files and running processes on it's first run. Therefore, deleting the original suspicious file will have no effect. "Spybot Search & Destroy" and Lavasoft "Adaware" are free utilities to clean out spyware and scumware much recommended on this group.

    For the 3 downloads:
    http://www.tomcoyote.org/hjt/
    http://www.safer-networking.org/en/index.html
    http://www.lavasoftusa.com/support/download/


    treehugger
     
    treehugger, Oct 20, 2004
    #3
  4. Adi

    Larry Crites Guest

    Maybe it's a virus file, of some sort. That "siol.net" is from where I keep
    getting those "MS Security Update" email viruses sent to me.

    Larry
    Unlock the Universe

    "treehugger" <> wrote in message
    news:...

    "Adi" <> wrote in message
    news:ulsdd.4568$...
    > Hi, experts!
    >
    > I found in startup of MSConfig configuration file value 67412966 and path
    > C:\Windows\System32\67412966.exe as startup file.
    >
    > But in that directory I didn't found that file. I make all directories and
    > files visible.
    >
    > Under Startup group in MSConfig I uncheck box behind it.
    >
    > After that I search in Registry and I found it (67412966.exe) and remove

    it
    > from Registry all values and restart computer.
    >
    > After new restart all was on old places and wasn't deleted.
    >
    > After that with System Mechanic I clean registry again and System Mechanic
    > recognize that value as bad, but after complet
    >
    > cleaning Registry and restart computer it was been still there.
    >
    > On Internet I put for search only number 67412966 and I get 3 pages of
    > extension xxx\gov with exactly that number
    >
    > and full other numbers,and I suspect for Spyware.
    >
    > Some program recognize this value, but not remove it.
    >
    > What file could be this, I am very shure thats no belong to Windoes XP.
    >
    >
    >


    It certainly does not belong to WinXP. Download "Hijack This" to help you
    analyze where it's lurking. It's likely that it will have dropped new,
    differently named .exe files and running processes on it's first run.
    Therefore, deleting the original suspicious file will have no effect.
    "Spybot Search & Destroy" and Lavasoft "Adaware" are free utilities to clean
    out spyware and scumware much recommended on this group.

    For the 3 downloads:
    http://www.tomcoyote.org/hjt/
    http://www.safer-networking.org/en/index.html
    http://www.lavasoftusa.com/support/download/


    treehugger
     
    Larry Crites, Oct 20, 2004
    #4
  5. Adi

    °Mike° Guest

    Online Antivirus scanners:
    ================
    http://housecall.trendmicro.com/housecall/start_corp.asp
    http://www.kaspersky.com/scanforvirus
    http://www3.ca.com/virusinfo/virusscan.aspx
    http://security.symantec.com/sscv6/default.asp
    http://www.pandasoftware.com/activescan/activescan.asp
    http://us.mcafee.com/root/mfs/default.asp
    http://commandondemand.com/eval/index.cfm
    http://www.ravantivirus.com/scan/ [See **** below.]
    http://www.bitdefender.com/scan/licence.php
    http://www.drweb-online.com/en/online_check.asp
    http://www.pcpitstop.com/antivirus/default.asp
    http://scan.sygatetech.com/prestealthscan.html
    http://www.virusoffice.com/clinic/index.cfm

    **** Caveat:
    http://archives.neohapsis.com/archives/bugtraq/2003-07/0240.html


    Anti-virus programs:
    --------------------
    KAV (Kaspersky)
    http://www.kaspersky.com/

    Sophos
    http://www.sophos.com/products/sav/

    eZ Antivirus (Computer Associates)
    http://www.my-etrust.com/products/Antivirus.cfm


    On Wed, 20 Oct 2004 13:54:01 +0200, in
    <ulsdd.4568$>
    Adi scrawled:

    >Hi, experts!
    >
    >I found in startup of MSConfig configuration file value 67412966 and path
    >C:\Windows\System32\67412966.exe as startup file.
    >
    >But in that directory I didn't found that file. I make all directories and
    >files visible.
    >
    >Under Startup group in MSConfig I uncheck box behind it.
    >
    >After that I search in Registry and I found it (67412966.exe) and remove it
    >from Registry all values and restart computer.
    >
    >After new restart all was on old places and wasn't deleted.
    >
    >After that with System Mechanic I clean registry again and System Mechanic
    >recognize that value as bad, but after complet
    >
    >cleaning Registry and restart computer it was been still there.
    >
    >On Internet I put for search only number 67412966 and I get 3 pages of
    >extension xxx\gov with exactly that number
    >
    >and full other numbers,and I suspect for Spyware.
    >
    >Some program recognize this value, but not remove it.
    >
    >What file could be this, I am very shure thats no belong to Windoes XP.
    >
    >
    >
    >
    >


    --
    Basic computer maintenance
    http://uk.geocities.com/personel44/maintenance.html
     
    °Mike°, Oct 20, 2004
    #5
  6. Larry Crites wrote:
    > Maybe it's a virus file, of some sort. That "siol.net" is from where
    > I keep getting those "MS Security Update" email viruses sent to me.
    >
    > Larry
    > Unlock the Universe



    So why aren't you using mailwasher pro and just blocking the domain?
    bl.spamcop.net
    relays.ordb.org
    relays.vsi.com
    blacklist.spambag.org
    blackholes.intersil.net
    blackholes.wirehub.net

    All my mail is validated through these sites and I also add to my own
    blacklist.
     
    Trai La' Trash, Oct 21, 2004
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. canonjon
    Replies:
    2
    Views:
    939
    Mercury
    Sep 10, 2005
  2. PeterOut

    spyware.bearshare found by "Spyware Detector"

    PeterOut, Oct 27, 2007, in forum: Computer Support
    Replies:
    21
    Views:
    1,005
    Dustin Cook
    Nov 13, 2007
  3. PeterOut

    spyware.bearshare found by "Spyware Detector"

    PeterOut, Oct 27, 2007, in forum: Computer Security
    Replies:
    18
    Views:
    1,039
    Jim Watt
    Nov 14, 2007
  4. dfinc
    Replies:
    1
    Views:
    969
    Kayman
    Jan 23, 2009
  5. Dennis
    Replies:
    6
    Views:
    37,613
    Beauregard T. Shagnasty
    Nov 30, 2009
Loading...

Share This Page