hmmm... looks like a windows media player 10 spoof. go to start: run: and type msconfig and click on the startup tab. make a screenshot of that and post it. drac (what happens if you select the country and click go?)

Is it an autodialler? I had one on my laptop that would try and dial out overy so often. Norton, Zonealarm, pest patrol and spysweeper couldn't find and remove it.

What is "AdStatServ"??

Here's No. 3. You know, it has always annoyed me that the text comes after the attachment. It should come first, no?

its an autodialer, you need to do a search for it and delete all files belonging to it. check in my computer/dialup networking for the main dialup file. Another thing you could try is running spybot, don't scan your system just have spybot open, reboot your computer and let spybot do a scan on boot up. sometimes you'll find it is the only way spybot can remove a dialer like that. drac if you select your country and click on go you will dial up an international XXX site which could cost heaps for the phone call.

Attached Link: http://forums.techguy.org/archive/t-327616.html

badolin, this may sound like a stupid question but i have to ask it. have you got any folders with porn sites in your favourates. something that appeared since you have had that dialer on your system.

Ok LordOfAcid, how do I search for something I haven't got a name for? Please forgive me, I'm a PC newbie.

I got news for you Drac, I don't know anything thats running in that msconfig window.

badolin, first place you need to check is in my computer/ dialup networking. if it isn't in there then some how we need to figure out its name. most times it is something like Ezula.exe I frigging hope it isn't that one

I'm assuming this is XP. Have you run update and SR2 yet? If you have open ports then the junk can be pushed onto your machine from another infected computer that found your IP.

@LordOfAcid: I checked my favourites and I see no porn stuff.

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.rpcbot.html winole.exe is also spyware http://www.cybertechhelp.com/forums/archive/index.php/t-64168.html rspc seems to be a virus, the site contains fix jah.exe http://computercops.biz/postp461684.html ap9h4qmo http://www.superadblocker.com/spywaredisplay.html?id=1975 wsxsvc.exe http://www.liutilities.com/products/wintaskspro/processlibrary/wsxsvc/ don't know what euolwu is, but it shows up waaaay too many times. and there's no info for it on the net o_O but yeah. the threads should take you to the respective fixes, i'd suggest going into safe mode when applying patches/fixes, etc.

oh, and uncheck that empty startup item. the one saying nothing. it's dodgy

Attached Link: http://www.google.se/search?hl=sv&q=winole.exe&meta=

Damnit, Drac beat me to it... :)

bandolin go to windowseuolwu and right click on it then click on properties. see if you can find out what it is or belongs to. check the date it was installed on your system, if you find it was before the dialer appeared then don't worry about it, if it was installed around the same time you found that dialler then untick it in the msconfig startup menu and give your computer a reboot and see if the dialler is gone. This is hard, i find it easier sitting at the computer to solve these little problems :)

Dialup Networking? Is that in the control panels. Drac, you're scaring me. I thought I had protection out the ying yang before I even turned on my modem. And your telling I've been infected with all this stuff? How's that possible? I never have this kind of problems on my Mac. :-(

oh hang on you're on xp...ok xp user needed here....where is dialup networking on that system.

I don't know if XP has a processes tab (usually in the Task Manager, in Win 2k and NT), but you might also check that out. There's a site out there, don't remember the name, but it's either PC Cops or Computer Cops, that do a lot of good work, they use 'hijack this' (great program, but be careful what it asks you to delete; I lost my network card for a few minutes..;) and other programs. Good luck, and watch out for that junk on the internet..good luck.

badolin i run two firwalls, two anti-virus programs, 4 programs that scan for spyware/adware and malware(one you never want to get) on my computer. once ever week i get a virus or trojan/spyware. you can never be fully protected unless you stay off the intenet.

You guys are giving me great help, but there are so many suggestions I'm getting dizzy. I don't know where to start. Damn man, you have a LOT in the startup. I'm new to XP, I thought that was normal. Right now I'm trying housecall.antivirus....

You guys are giving me great help, but there are so many suggestions I'm getting dizzy. I don't know where to start. Damn man, you have a LOT in the startup. I'm new to XP, I thought that was normal. Right now I'm trying housecall.antivirus.... Ok, housecall ain't working. My machine is freezing up. Going for a restart, be back soon

Alt+Ctrl+Delete brings up the processes tab. Housecall should be able to find at least some stuff to remove/fix, but then do like Drac said in post #12, do a google search for the processes and see what theyre good for. Keep in there Bandolin, you eventually will get the hang of it, and it wont be this troublesome.

i can still remember the first virus i had on my poor little 486 dx266 it nearly killed me from shock. it was the CIH(Chernobyl) virus. i was even running an anti-virus program back then and that still didn't protect me against it.

The first thing you should kill is that msmsgs.exe. That's Windows Messenger. A hole in the head, that one. Servic.exe also looks verra suspicious cause it mimics services.exe and is not that. Yup. A worm. Kill. Winstat is a Trojan component. Kill. javavm is a part of mydoom virus. And there I thought why the hell you need to run Java Virtual Machine. adstatserv is a browser hijacker and might serve that pop up window. euolwu seems to be something completely new. It might not harmful, but I'd kill it just on principle. :-)= check other for suspicious names: http://www.liutilities.com/products/wintaskspro/processlibrary/ jusched is Java update scheduler. Kill, won't feel a thing. ctfmon, too. And open a folder in _windows Explorer, go to Tools -> View. Uncheck "Hide extensions for known file types". F&%$#$%"%&&(()()=? Microsoft and their dumb default decisions. Housecall might not run because a virus prevents it. Some viruses prevent the installation of antivirus programs, firewalls, and so on. Start Spybot's Teatimer after you clean the computer. It will usually prevent scum settling down in Registry. Download updates regularly. Run cleaning programs. Do not use Internet Explorer. Do not use Internet Explorer. Do not use...

Attached Link: http://www.mozilla.org/products/firefox/

Where is the Spybot S and D Teatimer? I can find no way to get it to scan on startup. It must be started by manually hitting the scan button.

There's no other version except the free one. First, download the new version: http://www.safer-networking.org/en/download/index.html Then find the advanced options. Or you can wait till tomorrow morning, my time, when I get to work. :-/ (It's midnight now.) And that screenshot of Rudy's is okay now. Go figure.

Huh?

Attached Link: http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Attached Link: http://www.sysinfo.org/startupinfo.html

Attached Link: http://www.answersthatwork.com/

You guys sure have a bunch of apps running in the background. Here is my msconfig screenie...

First, go to the Tech Support Guys web site and register (free registration) You must be registered to post.

Tech Support Guys

Then go to the Spychecker site and download HijackThis ver. 1.99 (207kb).

HijackThis Download Page

Run HijackThis and save log to disk.

Then go back to Tech Support Guys and select the forum that represents your OS and create a post that best describes your problem and copy and paste your HijackThis log. Your log will be dissected by the tech people there and they will offer the best remedies and tips to your particular problem. They will tell you, not to remove anything until theyve had a chance to see the log. They are excellent!

These two sites have been very helpful to me. http://www.blackviper.com http://www.pcpitstop.com

I don't know if anyone is still watching this thread, but I'm back on my Mac now. My PC has died. I'm currently in the process of finding out what all the processes are that are running on my machine.

I would actually suggest formatting the disk and start with a clean install. That way, you can add the applications you want one by one and simultaneously remove anything unnesessary from startup and autostart. And make the internet the final step, once an antivirus and/or firewall is installed. Any PC stuff, drives/updates needed, can be dowloaded with the Mac and burnt on a CD.

Did everyone notice the announcement on the address spoofing issue with firefox and opera (possibly Galleon too), only a minor security outage but one to be aware of.

Where's that at, Gog?