Re: New virus causes symbol to appear in notification area of taskbar
From: Bill Smith (billsmiths2001_at_yahoo.com)
Date: 05/25/03
- Next message: taurarian: "re Q817287 & 331953 & 811493 update failed"
- Previous message: cwong668: "Q817287 & 331953 & 811493 update failed"
- In reply to: Tom: "Re: New virus causes symbol to appear in notification area of taskbar"
- Next in thread: Tom: "Re: New virus causes symbol to appear in notification area of taskbar"
- Reply: Tom: "Re: New virus causes symbol to appear in notification area of taskbar"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 25 May 2003 01:39:39 -0500
You should change some of your settings. From microsoft internet explorer
click "tools" then "internet options." There are tabs on top. Select the
"advanced" tab. Make sure there is _not_ a check in the box beside either
"enable install on demand (internet explorer), or "enable install on demand
(other)". You should also uncheck "enable third party browser extensions"
and then restart your computer. What you are describing sounds like a third
party browser extension. That should make it unable to function with
internet explorer.
Other options:
1. Get the free Spybot program. It removes many of these kinds of
programs.
http://security.kolla.de/index.php?lang=en&page=download
2. From the main screen click the "Start" button (lower left corner), then
select "Run" and type in msconfig (Then click ok) Select the startup tab
on top of the microsoft configuration utility and uncheck web.exe so it
won't start when you boot your computer.
"Tom" <n5gar@NOSPAMrass.org> wrote in message
news:1a9b01c32257$f2048ef0$a101280a@phx.gbl...
> Tracy, Thanks for responding. In this case, web.exe
> says " <no title> " So I have not been able to locate the
> program yet.
>
> I found the web.exe file and reported it to Norton Anti-
> Virus. They replied that they have tested it and "web.exe
> does not appear to contain malicious code." It seems it
> is very difficult to get their attention. I am very
> disappointed with Norton Anti Virus.
>
> Here's what I told them:
>
> Running the latest-updated NAV definitions on the entire
> system yields nothing. No viruses are reported.
>
> This program apparently changes the normal start page on a
> browser to a foreign language ad page. I don't know what
> other functions it performs. I know I never took any
> action to download it or install it. It installed itself
> on my PC without my knowledge or permission.
>
> This program causes a program icon to appear in the
> notification area of my taskbar (the right bottom corner).
>
> This icon is a small blue question mark in a yellow
> square. Unlike the other icons that are supposed to be
> there, moving the pointer over this does not produce a
> message. Right clicking on it produces the following
> window:
>
> Show startpage
> Disconnect (grayed)
> Update
> Hide
>
> Left clicking the icon does not produce a response.
>
> I have discovered on closing various programs in Task
> Manager that removing one with the name "web.exe"
> temporarily removes the unwanted icon from the task bar.
>
> This is shown in Task Manager to take 4048 k of memory
> space.
>
> I then searched my system and found two copies of "web.exe"
>
> One was located at C:/windows/web.exe
> The 2nd one was at C:/windows/System32/web.exe
>
> Size of this file is listed as an 88 KB application.
>
> Both instances of web.exe appear to be the same. I could
> only send one of them, as you restrict virus reports to
> one per day per person. (Please send instructions if you
> need more.)
>
> I find that even after the above were moved, the unwanted
> program starts up anyway. So there is more to do. The
> web.exe is listed again in the Task Manager.
>
> Plus there may be another problem if web.exe is a real
> file that was written over by the virus web.exe.
>
> - - - After they responded the first time, I sent them
> this: - - -
>
> I can not be satisfied with a 'closing' of this
> submission, Tracking # ------
>
>
> Either the file I submitted, or another file that was
> installed on my computer that I have not been able to
> locate, generates the submitted file.
>
> It is malicious because:
>
> (1) Software was automatically installed on my computer
> without my knowledge or permission, just because I
> (inadvertently) visited a web page. No window appeared
> asking me if I wanted to save a file or install a program
> or file.
>
> (2) It takes over certain additional functions of the
> computer - - in addition to the unwanted install
> function. It appears to re-assign the home page
> designated for my browser. The new home page / opening
> page is a foreign advertising page. It adds an unwanted
> icon in the tray.
>
> (3) My attempt to remove it, by using "end process" in
> the Windows XP Task Manager does not end the process or
> remove the program.
>
> (4) There is no contact information included with the
> malicious program. There is no way I can find to get any
> information on this program or on how to remove it.
>
> (5) The malicious program is capable of contacting the
> Internet.
>
> Please look at this and my initial report again.
>
> - - -
>
> filename: web.exe
> result: See the developer notes
>
> Developer notes:
> web.exe does not appear to contain malicious code.
>
>
>
>
> >-----Original Message-----
> >Another way to locate which program is doing this --
> >(killing web.exe in the task manager could have also
> >killed the process triggering the symbol). Open the
> >taskbar properties and select hide inactive icons, then
> >click customize. This dialog box lists all the icons
> >that have been in your system tray and the "name" for the
> >icon. (Some are a little roundabout or repetative -- ICQ
> >has in our list right now, 1 for each "variety" and
> >some, like the new message one for ICQ somply says "New
> >message from #######". But you can use this to track
> >down what program's doing it.
> >
> >Tracy
> >
> >>-----Original Message-----
> >>I did a search and there's no "karen.exe" on my
> >>system.
> >>
> >>This "web.exe" is enough.
> >>
> >>I don't want to tinker with the registry just yet,
> >>until I get a response from the Anti-Virus people,
> >>or I'd look for something similar to what is described
> >>at http://sarc.com/avcenter/venc/data/w32.gokar.a@mm.html
> >>
> >>
> >>Thanks
> >>
> >>>-----Original Message-----
> >>>Tom,
> >>>
> >>>You might also want to check your Windows directory for
> >a
> >>file named
> >>>"karen.exe". If you find it then you may be infected
> >>with W32.Gokar.A
> >>>Info:
> >>http://sarc.com/avcenter/venc/data/w32.gokar.a@mm.html
> >>>
> >>>Regards,
> >>>Patrick Hallihan
> >>>MCSE,MCSA,MCDBA
> >>>
> >>>"Tom" <n5gar@NOSPAMrass.org> wrote in message
> >>>news:02f601c31efc$ce7609e0$a301280a@phx.gbl...
> >>>> Patrick, Thanks for responding.
> >>>>
> >>>> I think I've found it, but I'm not finished.
> >>>> I discovered on closing various programs in Task
> >>>> Manager that killing one with the name "web.exe"
> >>>> kills the unwanted symbol in the task bar.
> >>>>
> >>>> This is shown in Task Manager to have 4048 k
> >>>> of memory space.
> >>>>
> >>>> I then searched my system and found two copies of
> >>>> "web.exe"
> >>>>
> >>>> One was located at C:/windows/web.exe
> >>>> The 2nd one was at C:/windows/System32/web.exe
> >>>>
> >>>> Size of this file is listed as an 88 KB application.
> >>>>
> >>>> I have moved these elsewhere.
> >>>>
> >>>> I find that even after the above were moved, the
> >>>> unwanted program starts up anyway. So there is
> >>>> more to do. I assume I have moved the correct
> >>>> files.
> >>>>
> >>
> >>.
> >>
> >.
> >
- Next message: taurarian: "re Q817287 & 331953 & 811493 update failed"
- Previous message: cwong668: "Q817287 & 331953 & 811493 update failed"
- In reply to: Tom: "Re: New virus causes symbol to appear in notification area of taskbar"
- Next in thread: Tom: "Re: New virus causes symbol to appear in notification area of taskbar"
- Reply: Tom: "Re: New virus causes symbol to appear in notification area of taskbar"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
