another pest

From: Li'l Roberto (whoisit_at_nospam.net)
Date: 12/23/04 

Date: Thu, 23 Dec 2004 19:06:00 +1030

XP Home system is infected with something [probably a trojan] but I am
unable to find the files that run at startup.
Here are the details:
msconfig shows two entries: in the startup group
1. nrkmavt.exe
2. gkbdu.exe
these two entries are also present in
HKCU - run key
HKLM - run key
both point to the C:\windows\system32\ folder, however neither file is
visible in that folder or anywere else on the system ??? even with show
all files hidden\system and protected is enabled.
Running a search with wild cards pulls up negative, delete them and
they are back next reboot so my guess is there is another file
monitering their present and recreating them , but what ?.
Scans with the usual tools comes up negative.
Any help greatly appreciated.

rgds
Li'l Roberto

Relevant Pages

  • Re: Startup Programs has hundreds of entries
    ... The entries are completely varied and include kb files, dlls, and even the ... The Startup indication is that these are in the user's Start Menu, Programs, Startup folder. ... >> programs that lists them. ...
    (microsoft.public.windows.mediacenter)
  • Re: Startup Programs has hundreds of entries
    ... I didn't read her comment about "looking in system information" as meaning ... have you looked in the Startup tab in the msconfig program or used ... >> users have minimal entries. ... >>> Programs, Startup folder. ...
    (microsoft.public.windows.mediacenter)
  • Re: Startup program
    ... StartUp is one word and there are a number of these folders. ... When starting up windows the folder "Program" also starts up. ... startup entries where the "Program Files" folder is in the path. ... Make sure the paths are in quotes. ...
    (microsoft.public.windowsxp.general)
  • Re: Macros Disabled
    ... Updating Word from Microsoft's website will not put Add-Ins in your startup ... See also the MVP FAQ: http://word.mvps.org/FAQs/ which is awesome! ... it out of the Startup folder? ... If you don't want any macros to run, ever, and you don't want to be ...
    (microsoft.public.word.newusers)
  • Re: What is going wrong here?
    ... Are you trying to get the setting of the Startup Path or change it? ... ' This is needed because if the folder is a network drive rather ... Make it your job finisher template or another ...
    (microsoft.public.word.vba.general)