Strange Behavior

There is a new entry in my start-up items: Javaub32.exe. Even if I disable
it from starting up using a startup manager, it keeps reappearing. If I
disable it after starting the computer, it re-enables itself after I open
Internet Explorer. Any ideas what this file is? It is located in the
Windows/System folder and has only been on my computer a few days. I haven't
installed anything recently so I suppose it got there somehow while browsing
the internet. I do have Adaware and Spybot installed and will try running
them after getting the latest updates. Just thought someone out there might
know what I'm dealing with.

Thanks,
Leigh

--
(Remove the NOT to reply by email.)

Leigh -

No entry of a sort (or derivations) are found in Google, nor on my W98se PC.
It sounds as though some pest has taken a ride into yours though.

Good idea to update and scan using Ad-Aware and Spybot; it *may* offer a
clue, and/or fix it. You might consider adding a couple of extra freeware
anti-spyware utilities to help you prevent, detect, and remove this, or
other unwanted malware/spyware entities which may wish to clamber aboard.

CWShredder (cleans all Cool Web Search malware)
http://www.majorgeeks.com/download4086.html
CWShredder Tutorial
http://www.bleepingcomputer.com/foru...howtutorial=47

This item below is designed to *prevent* installation of malware and the
like by comparing known CLSID's of these "bad guys" with what is in its
definitions. It doesn't remove anything, nor will it fix anything that is
already in your PC. Rather, it will prevent re-installation of the item once
it has been removed either manually, or by use of another program which will
remove the spyware.

SpywareBlaster (prevents installation of spyware, Trojans, etc.)
http://www.javacoolsoftware.com/spywareguard.html
SpywareBlaster Tutorial
http://www.bleepingcomputer.com/foru...howtutorial=49

Lastly there is HijackThis. Hijack this is a very powerful, last resort type
of program which is generally best used in conjunction with help from those
who deal with the findings of the log created by the HijackThis scan. It
does nothing in the scan itself; it merely says what is in and running on
your PC. The items must be checked-marked to be "cleaned". Therein is the
issue; you must know *exactly* what you are checking-off before you proceed.
If you don't, you can quite possibly disable many useful and vital functions
of your PC.

HijackThis
http://www.spywareinfo.com/~merijn/downloads.html
If the preceding site is down, you may get HijackThis from Major Geeks
(amongst other sites as well)
Hijack This (from Major Geeks)
http://www.majorgeeks.com/download3155.html

HijackThis Tutorials **(MUST READ)**
http://www.spywareinfo.com/~merijn/htlogtutorial.html
http://www.bleepingcomputer.com/foru...howtutorial=42
http://hjt.wizardsofwebsites.com/

Where to seek help with your HijackThis scan log
SpywareInfo Forums
http://forums.spywareinfo.com/
other help forums for HijackThis:
Net-Integration
http://forums.net-integration.net/index.php?c=19
TomCoyote
http://forums.tomcoyote.com/index.php?showforum=27

More general info on Spyware, Malware, and other undesirable unwanted
spyware, etc:
Jim Eshelmans WSC Aumha site:
http://aumha.org/a/parasite.htm
more details from Jim and his site
http://www.aumha.org/a/quickfix.htm
His quick scan for parasites (scripting must be enabled for this to work)
http://www.aumha.org/a/noads.htm

A free on-line Trojan scanner
GFI
http://www.windowsecurity.com/trojanscan/

HTH -
--

LuckyStrike

--------------------------------------------------------------------


"Leigh" wrote in message
...
There is a new entry in my start-up items: Javaub32.exe. Even if I disable
it from starting up using a startup manager, it keeps reappearing. If I
disable it after starting the computer, it re-enables itself after I open
Internet Explorer. Any ideas what this file is? It is located in the
Windows/System folder and has only been on my computer a few days. I
haven't
installed anything recently so I suppose it got there somehow while
browsing
the internet. I do have Adaware and Spybot installed and will try running
them after getting the latest updates. Just thought someone out there
might
know what I'm dealing with.

Thanks,
Leigh

--
(Remove the NOT to reply by email.)

If it starts when IE is clicked, it may be a BHO. So... well, I know
some of the apps LuckyStrike posted can get them... still...

Better check for a BHO (Browser Helper Object), which attaches to
Explorer meaning to add functionality. However, poorly coded, they may
conflict with each other or Explorer. And some are "badies".

http://www.pcmag.com/ BHOCop
http://www.definitivesolutions.com/ BHODemon


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Leigh" wrote in message
...
| There is a new entry in my start-up items: Javaub32.exe. Even if I
disable
| it from starting up using a startup manager, it keeps reappearing. If
I
| disable it after starting the computer, it re-enables itself after I
open
| Internet Explorer. Any ideas what this file is? It is located in the
| Windows/System folder and has only been on my computer a few days. I
haven't
| installed anything recently so I suppose it got there somehow while
browsing
| the internet. I do have Adaware and Spybot installed and will try
running
| them after getting the latest updates. Just thought someone out there
might
| know what I'm dealing with.
|
| Thanks,
| Leigh
|
| --
| (Remove the NOT to reply by email.)
|
|

As PCR mentioned, it could be some BHO. Therefore what better moment than
now to add yet another app which helps to find out what's in your PC? So,
here I offer BHOlist.exe which is the front end for Tony Klein's fairly
exhaustive compilation (always keeps on top of them too) of BHO's, and what
are known bad BHO's is So, if you haven't enough with those that have
already been offered up, here is yet another one of the freeware variety.
G

BHOlist 1.40
http://www.softpedia.com/public/cat/14/5/14-5-99.shtml

also a general list can be found he
http://www.computercops.net/CLSID.html
An older (soon to be updated list) here
http://www.spywareinfo.com/bhos/
--

LuckyStrike

--------------------------------------------------------------------

"Leigh" wrote in message
...
There is a new entry in my start-up items: Javaub32.exe. Even if I disable
it from starting up using a startup manager, it keeps reappearing. If I
disable it after starting the computer, it re-enables itself after I open
Internet Explorer. Any ideas what this file is? It is located in the
Windows/System folder and has only been on my computer a few days. I
haven't
installed anything recently so I suppose it got there somehow while
browsing
the internet. I do have Adaware and Spybot installed and will try running
them after getting the latest updates. Just thought someone out there
might
know what I'm dealing with.

Thanks,
Leigh

--
(Remove the NOT to reply by email.)

Thanks for all the input! I did run AdAware and Spybot along with Norton
Antivirus. Between the three of these, 3 viruses were detected and some home
page hijackers and some malware--one of which was the javaub32.exe program.
I'm still having problems with my homepage being hijacked but will have to
do some more research. The page that is loading refers to :
res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please let
me know!

Thanks!
Leigh

--
(Remove the NOT to reply by email.)
"Leigh" wrote in message
...
There is a new entry in my start-up items: Javaub32.exe. Even if I disable
it from starting up using a startup manager, it keeps reappearing. If I
disable it after starting the computer, it re-enables itself after I open
Internet Explorer. Any ideas what this file is? It is located in the
Windows/System folder and has only been on my computer a few days. I
haven't
installed anything recently so I suppose it got there somehow while
browsing
the internet. I do have Adaware and Spybot installed and will try running
them after getting the latest updates. Just thought someone out there
might
know what I'm dealing with.

Thanks,
Leigh

--
(Remove the NOT to reply by email.)

You are welcome. There may be manual finishing touches to perform after
a virus has been removed. Have you checked for it at your scanner's
site? Can it be as easy as...?...

"Control Panel, Internet Options, General tab, Home Page section, Use
Default button".


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Leigh" wrote in message
...
| Thanks for all the input! I did run AdAware and Spybot along with
Norton
| Antivirus. Between the three of these, 3 viruses were detected and
some home
| page hijackers and some malware--one of which was the javaub32.exe
program.
| I'm still having problems with my homepage being hijacked but will
have to
| do some more research. The page that is loading refers to :
| res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please
let
| me know!
|
| Thanks!
| Leigh
|
| --
| (Remove the NOT to reply by email.)
| "Leigh" wrote in message
| ...
| There is a new entry in my start-up items: Javaub32.exe. Even if I
disable
| it from starting up using a startup manager, it keeps reappearing.
If I
| disable it after starting the computer, it re-enables itself after I
open
| Internet Explorer. Any ideas what this file is? It is located in the
| Windows/System folder and has only been on my computer a few days. I
| haven't
| installed anything recently so I suppose it got there somehow while
| browsing
| the internet. I do have Adaware and Spybot installed and will try
running
| them after getting the latest updates. Just thought someone out
there
| might
| know what I'm dealing with.
|
| Thanks,
| Leigh
|
| --
| (Remove the NOT to reply by email.)
|
|
|
|

I've tried changing my home page but it keeps reverting back to the
res:kwreu.dll/index.html#2789 page. I have used AdAware; the program finds
the offending hijacker and removes it, but when I go back online, the file
reappears. I guess the next step will be to search my registry for
references to this file. I'm at my wit's end!

Thanks,
Leigh

--
(Remove the NOT to reply by email.)
"PCR" wrote in message
...
You are welcome. There may be manual finishing touches to perform after
a virus has been removed. Have you checked for it at your scanner's
site? Can it be as easy as...?...

"Control Panel, Internet Options, General tab, Home Page section, Use
Default button".


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Leigh" wrote in message
...
| Thanks for all the input! I did run AdAware and Spybot along with
Norton
| Antivirus. Between the three of these, 3 viruses were detected and
some home
| page hijackers and some malware--one of which was the javaub32.exe
program.
| I'm still having problems with my homepage being hijacked but will
have to
| do some more research. The page that is loading refers to :
| res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please
let
| me know!
|
| Thanks!
| Leigh
|
| --
| (Remove the NOT to reply by email.)
| "Leigh" wrote in message
| ...
| There is a new entry in my start-up items: Javaub32.exe. Even if I
disable
| it from starting up using a startup manager, it keeps reappearing.
If I
| disable it after starting the computer, it re-enables itself after I
open
| Internet Explorer. Any ideas what this file is? It is located in the
| Windows/System folder and has only been on my computer a few days. I
| haven't
| installed anything recently so I suppose it got there somehow while
| browsing
| the internet. I do have Adaware and Spybot installed and will try
running
| them after getting the latest updates. Just thought someone out
there
| might
| know what I'm dealing with.
|
| Thanks,
| Leigh
|
| --
| (Remove the NOT to reply by email.)
|
|
|
|

Hi -

Two other things you can try. This is if you don't want to fiddle around in
the Registry.

1) Install and run SpywareGuard
http://www.javacoolsoftware.com/spywareguard.html
Tutorial for SpywareGuard
http://www.bleepingcomputer.com/foru...howtutorial=50

After setting it up, change your homepage to what you want it to be. Then,
run SpywareGuard, it should notify you of any attempt to change that page by
a Hijacker. Then simply deny the change attempt. Or it may say, Home (or
search page) has been changed; What do you want to do? Then look at what you
had and what the attempted page is. Do not allow the Hijacker page. This
will seem more clear when you see the dialogue box.
If that remedies it, then you might wish to avoid installing Hijack This.
But it is a good program. Powerful, and hazardous if used capriciously, but
*very* effective when used properly.

2) Install, update and run HijackThis.

HijackThis
http://www.spywareinfo.com/~merijn/downloads.html
If the preceding site is down, you may get HijackThis from Major Geeks
(amongst other sites as well)
Hijack This (from Major Geeks)
http://www.majorgeeks.com/download3155.html

HijackThis Tutorials **(MUST READ)**
http://www.spywareinfo.com/~merijn/htlogtutorial.html
http://www.bleepingcomputer.com/foru...howtutorial=42
http://hjt.wizardsofwebsites.com/

Hijack this is a very powerful, last resort type of program which is
generally best used in conjunction with help from those
who deal with the findings of the log created by the HijackThis scan. It
does nothing in the scan itself; it merely says what is in and running on
your PC. The items must be checked-marked to be "cleaned". Therein is the
issue; you must know *exactly* what you are checking-off before you proceed.
If you don't, you can quite possibly disable many useful and vital functions
of your PC. It is quite safe when used with help. The Tutorials will be of
great value, and if you are ONLY going to fix your home page, it shouldn't
be too difficult.

Where to seek help with your HijackThis scan log
SpywareInfo Forums
http://forums.spywareinfo.com/
other help forums for HijackThis:
Net-Integration
http://forums.net-integration.net/index.php?c=19
TomCoyote
http://forums.tomcoyote.com/index.php?showforum=27

HTH -
--
LuckyStrike

--------------------------------------------------------------------


"Leigh" wrote in message
...
I've tried changing my home page but it keeps reverting back to the
res:kwreu.dll/index.html#2789 page. I have used AdAware; the program finds
the offending hijacker and removes it, but when I go back online, the file
reappears. I guess the next step will be to search my registry for
references to this file. I'm at my wit's end!

Thanks,
Leigh

--
(Remove the NOT to reply by email.)
"PCR" wrote in message
...
You are welcome. There may be manual finishing touches to perform after
a virus has been removed. Have you checked for it at your scanner's
site? Can it be as easy as...?...

"Control Panel, Internet Options, General tab, Home Page section, Use
Default button".


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Leigh" wrote in message
...
| Thanks for all the input! I did run AdAware and Spybot along with
Norton
| Antivirus. Between the three of these, 3 viruses were detected and
some home
| page hijackers and some malware--one of which was the javaub32.exe
program.
| I'm still having problems with my homepage being hijacked but will
have to
| do some more research. The page that is loading refers to :
| res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please
let
| me know!
|
| Thanks!
| Leigh
|
| --
| (Remove the NOT to reply by email.)
| "Leigh" wrote in message
| ...
| There is a new entry in my start-up items: Javaub32.exe. Even if I
disable
| it from starting up using a startup manager, it keeps reappearing.
If I
| disable it after starting the computer, it re-enables itself after I
open
| Internet Explorer. Any ideas what this file is? It is located in the
| Windows/System folder and has only been on my computer a few days. I
| haven't
| installed anything recently so I suppose it got there somehow while
| browsing
| the internet. I do have Adaware and Spybot installed and will try
running
| them after getting the latest updates. Just thought someone out
there
| might
| know what I'm dealing with.
|
| Thanks,
| Leigh
|
| --
| (Remove the NOT to reply by email.)
|
|
|
|

Let me see where my home page...
http://desktop.presario.net/scripts/...LC=0409&c=1c00
.... shows up...

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Default_Page_URL "It's in a string here"
Start Page "Well, it is here too"

It's in that Registry key twice, & nowhere else.


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Leigh" wrote in message
...
| I've tried changing my home page but it keeps reverting back to the
| res:kwreu.dll/index.html#2789 page. I have used AdAware; the program
finds
| the offending hijacker and removes it, but when I go back online, the
file
| reappears. I guess the next step will be to search my registry for
| references to this file. I'm at my wit's end!
|
| Thanks,
| Leigh
|
| --
| (Remove the NOT to reply by email.)
| "PCR" wrote in message
| ...
| You are welcome. There may be manual finishing touches to perform
after
| a virus has been removed. Have you checked for it at your scanner's
| site? Can it be as easy as...?...
|
| "Control Panel, Internet Options, General tab, Home Page section,
Use
| Default button".
|
|
| --
| Thanks or Good Luck,
| There may be humor in this post, and,
| Naturally, you will not sue,
| should things get worse after this,
| PCR
|
| "Leigh" wrote in message
| ...
| | Thanks for all the input! I did run AdAware and Spybot along with
| Norton
| | Antivirus. Between the three of these, 3 viruses were detected and
| some home
| | page hijackers and some malware--one of which was the javaub32.exe
| program.
| | I'm still having problems with my homepage being hijacked but will
| have to
| | do some more research. The page that is loading refers to :
| | res:kwreu.dll/index.html#2789. If anyone has any ideas on this,
please
| let
| | me know!
| |
| | Thanks!
| | Leigh
| |
| | --
| | (Remove the NOT to reply by email.)
| | "Leigh" wrote in message
| | ...
| | There is a new entry in my start-up items: Javaub32.exe. Even if
I
| disable
| | it from starting up using a startup manager, it keeps
reappearing.
| If I
| | disable it after starting the computer, it re-enables itself
after I
| open
| | Internet Explorer. Any ideas what this file is? It is located in
the
| | Windows/System folder and has only been on my computer a few
days. I
| | haven't
| | installed anything recently so I suppose it got there somehow
while
| | browsing
| | the internet. I do have Adaware and Spybot installed and will
try
| running
| | them after getting the latest updates. Just thought someone out
| there
| | might
| | know what I'm dealing with.
| |
| | Thanks,
| | Leigh
| |
| | --
| | (Remove the NOT to reply by email.)
| |
| |
| |
| |
|
|
|
|

Same location for me, and two entries also, but without a default page;
simply a Start Page and a Start Page_bak.
http:\\www.refdesk.com is the same on both of them.
--
LuckyStrike

--------------------------------------------------------------------
"PCR" wrote in message
...
Let me see where my home page...

http://desktop.presario.net/scripts/...LC=0409&c=1c00
... shows up...

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Default_Page_URL "It's in a string here"
Start Page "Well, it is here too"

It's in that Registry key twice, & nowhere else.


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Leigh" wrote in message
...
| I've tried changing my home page but it keeps reverting back to the
| res:kwreu.dll/index.html#2789 page. I have used AdAware; the program
finds
| the offending hijacker and removes it, but when I go back online, the
file
| reappears. I guess the next step will be to search my registry for
| references to this file. I'm at my wit's end!
|
| Thanks,
| Leigh
|
| --
| (Remove the NOT to reply by email.)
| "PCR" wrote in message
| ...
| You are welcome. There may be manual finishing touches to perform
after
| a virus has been removed. Have you checked for it at your scanner's
| site? Can it be as easy as...?...
|
| "Control Panel, Internet Options, General tab, Home Page section,
Use
| Default button".
|
|
| --
| Thanks or Good Luck,
| There may be humor in this post, and,
| Naturally, you will not sue,
| should things get worse after this,
| PCR
|
| "Leigh" wrote in message
| ...
| | Thanks for all the input! I did run AdAware and Spybot along with
| Norton
| | Antivirus. Between the three of these, 3 viruses were detected and
| some home
| | page hijackers and some malware--one of which was the javaub32.exe
| program.
| | I'm still having problems with my homepage being hijacked but will
| have to
| | do some more research. The page that is loading refers to :
| | res:kwreu.dll/index.html#2789. If anyone has any ideas on this,
please
| let
| | me know!
| |
| | Thanks!
| | Leigh
| |
| | --
| | (Remove the NOT to reply by email.)
| | "Leigh" wrote in message
| | ...
| | There is a new entry in my start-up items: Javaub32.exe. Even if
I
| disable
| | it from starting up using a startup manager, it keeps
reappearing.
| If I
| | disable it after starting the computer, it re-enables itself
after I
| open
| | Internet Explorer. Any ideas what this file is? It is located in
the
| | Windows/System folder and has only been on my computer a few
days. I
| | haven't
| | installed anything recently so I suppose it got there somehow
while
| | browsing
| | the internet. I do have Adaware and Spybot installed and will
try
| running
| | them after getting the latest updates. Just thought someone out
| there
| | might
| | know what I'm dealing with.
| |
| | Thanks,
| | Leigh
| |
| | --
| | (Remove the NOT to reply by email.)
| |
| |
| |
| |
|
|
|
|