If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
Strange Behavior
There is a new entry in my start-up items: Javaub32.exe. Even if I disable
it from starting up using a startup manager, it keeps reappearing. If I disable it after starting the computer, it re-enables itself after I open Internet Explorer. Any ideas what this file is? It is located in the Windows/System folder and has only been on my computer a few days. I haven't installed anything recently so I suppose it got there somehow while browsing the internet. I do have Adaware and Spybot installed and will try running them after getting the latest updates. Just thought someone out there might know what I'm dealing with. Thanks, Leigh -- (Remove the NOT to reply by email.) |
#2
|
|||
|
|||
Strange Behavior
Leigh -
No entry of a sort (or derivations) are found in Google, nor on my W98se PC. It sounds as though some pest has taken a ride into yours though. Good idea to update and scan using Ad-Aware and Spybot; it *may* offer a clue, and/or fix it. You might consider adding a couple of extra freeware anti-spyware utilities to help you prevent, detect, and remove this, or other unwanted malware/spyware entities which may wish to clamber aboard. CWShredder (cleans all Cool Web Search malware) http://www.majorgeeks.com/download4086.html CWShredder Tutorial http://www.bleepingcomputer.com/foru...howtutorial=47 This item below is designed to *prevent* installation of malware and the like by comparing known CLSID's of these "bad guys" with what is in its definitions. It doesn't remove anything, nor will it fix anything that is already in your PC. Rather, it will prevent re-installation of the item once it has been removed either manually, or by use of another program which will remove the spyware. SpywareBlaster (prevents installation of spyware, Trojans, etc.) http://www.javacoolsoftware.com/spywareguard.html SpywareBlaster Tutorial http://www.bleepingcomputer.com/foru...howtutorial=49 Lastly there is HijackThis. Hijack this is a very powerful, last resort type of program which is generally best used in conjunction with help from those who deal with the findings of the log created by the HijackThis scan. It does nothing in the scan itself; it merely says what is in and running on your PC. The items must be checked-marked to be "cleaned". Therein is the issue; you must know *exactly* what you are checking-off before you proceed. If you don't, you can quite possibly disable many useful and vital functions of your PC. HijackThis http://www.spywareinfo.com/~merijn/downloads.html If the preceding site is down, you may get HijackThis from Major Geeks (amongst other sites as well) Hijack This (from Major Geeks) http://www.majorgeeks.com/download3155.html HijackThis Tutorials **(MUST READ)** http://www.spywareinfo.com/~merijn/htlogtutorial.html http://www.bleepingcomputer.com/foru...howtutorial=42 http://hjt.wizardsofwebsites.com/ Where to seek help with your HijackThis scan log SpywareInfo Forums http://forums.spywareinfo.com/ other help forums for HijackThis: Net-Integration http://forums.net-integration.net/index.php?c=19 TomCoyote http://forums.tomcoyote.com/index.php?showforum=27 More general info on Spyware, Malware, and other undesirable unwanted spyware, etc: Jim Eshelmans WSC Aumha site: http://aumha.org/a/parasite.htm more details from Jim and his site http://www.aumha.org/a/quickfix.htm His quick scan for parasites (scripting must be enabled for this to work) http://www.aumha.org/a/noads.htm A free on-line Trojan scanner GFI http://www.windowsecurity.com/trojanscan/ HTH - -- LuckyStrike -------------------------------------------------------------------- "Leigh" wrote in message ... There is a new entry in my start-up items: Javaub32.exe. Even if I disable it from starting up using a startup manager, it keeps reappearing. If I disable it after starting the computer, it re-enables itself after I open Internet Explorer. Any ideas what this file is? It is located in the Windows/System folder and has only been on my computer a few days. I haven't installed anything recently so I suppose it got there somehow while browsing the internet. I do have Adaware and Spybot installed and will try running them after getting the latest updates. Just thought someone out there might know what I'm dealing with. Thanks, Leigh -- (Remove the NOT to reply by email.) |
#4
|
|||
|
|||
Strange Behavior
As PCR mentioned, it could be some BHO. Therefore what better moment than
now to add yet another app which helps to find out what's in your PC? So, here I offer BHOlist.exe which is the front end for Tony Klein's fairly exhaustive compilation (always keeps on top of them too) of BHO's, and what are known bad BHO's is So, if you haven't enough with those that have already been offered up, here is yet another one of the freeware variety. G BHOlist 1.40 http://www.softpedia.com/public/cat/14/5/14-5-99.shtml also a general list can be found he http://www.computercops.net/CLSID.html An older (soon to be updated list) here http://www.spywareinfo.com/bhos/ -- LuckyStrike -------------------------------------------------------------------- "Leigh" wrote in message ... There is a new entry in my start-up items: Javaub32.exe. Even if I disable it from starting up using a startup manager, it keeps reappearing. If I disable it after starting the computer, it re-enables itself after I open Internet Explorer. Any ideas what this file is? It is located in the Windows/System folder and has only been on my computer a few days. I haven't installed anything recently so I suppose it got there somehow while browsing the internet. I do have Adaware and Spybot installed and will try running them after getting the latest updates. Just thought someone out there might know what I'm dealing with. Thanks, Leigh -- (Remove the NOT to reply by email.) |
#5
|
|||
|
|||
Strange Behavior
Thanks for all the input! I did run AdAware and Spybot along with Norton
Antivirus. Between the three of these, 3 viruses were detected and some home page hijackers and some malware--one of which was the javaub32.exe program. I'm still having problems with my homepage being hijacked but will have to do some more research. The page that is loading refers to : res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please let me know! Thanks! Leigh -- (Remove the NOT to reply by email.) "Leigh" wrote in message ... There is a new entry in my start-up items: Javaub32.exe. Even if I disable it from starting up using a startup manager, it keeps reappearing. If I disable it after starting the computer, it re-enables itself after I open Internet Explorer. Any ideas what this file is? It is located in the Windows/System folder and has only been on my computer a few days. I haven't installed anything recently so I suppose it got there somehow while browsing the internet. I do have Adaware and Spybot installed and will try running them after getting the latest updates. Just thought someone out there might know what I'm dealing with. Thanks, Leigh -- (Remove the NOT to reply by email.) |
#6
|
|||
|
|||
Strange Behavior
You are welcome. There may be manual finishing touches to perform after
a virus has been removed. Have you checked for it at your scanner's site? Can it be as easy as...?... "Control Panel, Internet Options, General tab, Home Page section, Use Default button". -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, should things get worse after this, PCR "Leigh" wrote in message ... | Thanks for all the input! I did run AdAware and Spybot along with Norton | Antivirus. Between the three of these, 3 viruses were detected and some home | page hijackers and some malware--one of which was the javaub32.exe program. | I'm still having problems with my homepage being hijacked but will have to | do some more research. The page that is loading refers to : | res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please let | me know! | | Thanks! | Leigh | | -- | (Remove the NOT to reply by email.) | "Leigh" wrote in message | ... | There is a new entry in my start-up items: Javaub32.exe. Even if I disable | it from starting up using a startup manager, it keeps reappearing. If I | disable it after starting the computer, it re-enables itself after I open | Internet Explorer. Any ideas what this file is? It is located in the | Windows/System folder and has only been on my computer a few days. I | haven't | installed anything recently so I suppose it got there somehow while | browsing | the internet. I do have Adaware and Spybot installed and will try running | them after getting the latest updates. Just thought someone out there | might | know what I'm dealing with. | | Thanks, | Leigh | | -- | (Remove the NOT to reply by email.) | | | | |
#7
|
|||
|
|||
Strange Behavior
I've tried changing my home page but it keeps reverting back to the
res:kwreu.dll/index.html#2789 page. I have used AdAware; the program finds the offending hijacker and removes it, but when I go back online, the file reappears. I guess the next step will be to search my registry for references to this file. I'm at my wit's end! Thanks, Leigh -- (Remove the NOT to reply by email.) "PCR" wrote in message ... You are welcome. There may be manual finishing touches to perform after a virus has been removed. Have you checked for it at your scanner's site? Can it be as easy as...?... "Control Panel, Internet Options, General tab, Home Page section, Use Default button". -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, should things get worse after this, PCR "Leigh" wrote in message ... | Thanks for all the input! I did run AdAware and Spybot along with Norton | Antivirus. Between the three of these, 3 viruses were detected and some home | page hijackers and some malware--one of which was the javaub32.exe program. | I'm still having problems with my homepage being hijacked but will have to | do some more research. The page that is loading refers to : | res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please let | me know! | | Thanks! | Leigh | | -- | (Remove the NOT to reply by email.) | "Leigh" wrote in message | ... | There is a new entry in my start-up items: Javaub32.exe. Even if I disable | it from starting up using a startup manager, it keeps reappearing. If I | disable it after starting the computer, it re-enables itself after I open | Internet Explorer. Any ideas what this file is? It is located in the | Windows/System folder and has only been on my computer a few days. I | haven't | installed anything recently so I suppose it got there somehow while | browsing | the internet. I do have Adaware and Spybot installed and will try running | them after getting the latest updates. Just thought someone out there | might | know what I'm dealing with. | | Thanks, | Leigh | | -- | (Remove the NOT to reply by email.) | | | | |
#8
|
|||
|
|||
Strange Behavior
Hi -
Two other things you can try. This is if you don't want to fiddle around in the Registry. 1) Install and run SpywareGuard http://www.javacoolsoftware.com/spywareguard.html Tutorial for SpywareGuard http://www.bleepingcomputer.com/foru...howtutorial=50 After setting it up, change your homepage to what you want it to be. Then, run SpywareGuard, it should notify you of any attempt to change that page by a Hijacker. Then simply deny the change attempt. Or it may say, Home (or search page) has been changed; What do you want to do? Then look at what you had and what the attempted page is. Do not allow the Hijacker page. This will seem more clear when you see the dialogue box. If that remedies it, then you might wish to avoid installing Hijack This. But it is a good program. Powerful, and hazardous if used capriciously, but *very* effective when used properly. 2) Install, update and run HijackThis. HijackThis http://www.spywareinfo.com/~merijn/downloads.html If the preceding site is down, you may get HijackThis from Major Geeks (amongst other sites as well) Hijack This (from Major Geeks) http://www.majorgeeks.com/download3155.html HijackThis Tutorials **(MUST READ)** http://www.spywareinfo.com/~merijn/htlogtutorial.html http://www.bleepingcomputer.com/foru...howtutorial=42 http://hjt.wizardsofwebsites.com/ Hijack this is a very powerful, last resort type of program which is generally best used in conjunction with help from those who deal with the findings of the log created by the HijackThis scan. It does nothing in the scan itself; it merely says what is in and running on your PC. The items must be checked-marked to be "cleaned". Therein is the issue; you must know *exactly* what you are checking-off before you proceed. If you don't, you can quite possibly disable many useful and vital functions of your PC. It is quite safe when used with help. The Tutorials will be of great value, and if you are ONLY going to fix your home page, it shouldn't be too difficult. Where to seek help with your HijackThis scan log SpywareInfo Forums http://forums.spywareinfo.com/ other help forums for HijackThis: Net-Integration http://forums.net-integration.net/index.php?c=19 TomCoyote http://forums.tomcoyote.com/index.php?showforum=27 HTH - -- LuckyStrike -------------------------------------------------------------------- "Leigh" wrote in message ... I've tried changing my home page but it keeps reverting back to the res:kwreu.dll/index.html#2789 page. I have used AdAware; the program finds the offending hijacker and removes it, but when I go back online, the file reappears. I guess the next step will be to search my registry for references to this file. I'm at my wit's end! Thanks, Leigh -- (Remove the NOT to reply by email.) "PCR" wrote in message ... You are welcome. There may be manual finishing touches to perform after a virus has been removed. Have you checked for it at your scanner's site? Can it be as easy as...?... "Control Panel, Internet Options, General tab, Home Page section, Use Default button". -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, should things get worse after this, PCR "Leigh" wrote in message ... | Thanks for all the input! I did run AdAware and Spybot along with Norton | Antivirus. Between the three of these, 3 viruses were detected and some home | page hijackers and some malware--one of which was the javaub32.exe program. | I'm still having problems with my homepage being hijacked but will have to | do some more research. The page that is loading refers to : | res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please let | me know! | | Thanks! | Leigh | | -- | (Remove the NOT to reply by email.) | "Leigh" wrote in message | ... | There is a new entry in my start-up items: Javaub32.exe. Even if I disable | it from starting up using a startup manager, it keeps reappearing. If I | disable it after starting the computer, it re-enables itself after I open | Internet Explorer. Any ideas what this file is? It is located in the | Windows/System folder and has only been on my computer a few days. I | haven't | installed anything recently so I suppose it got there somehow while | browsing | the internet. I do have Adaware and Spybot installed and will try running | them after getting the latest updates. Just thought someone out there | might | know what I'm dealing with. | | Thanks, | Leigh | | -- | (Remove the NOT to reply by email.) | | | | |
#9
|
|||
|
|||
Strange Behavior
Let me see where my home page...
http://desktop.presario.net/scripts/...LC=0409&c=1c00 .... shows up... HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Default_Page_URL "It's in a string here" Start Page "Well, it is here too" It's in that Registry key twice, & nowhere else. -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, should things get worse after this, PCR "Leigh" wrote in message ... | I've tried changing my home page but it keeps reverting back to the | res:kwreu.dll/index.html#2789 page. I have used AdAware; the program finds | the offending hijacker and removes it, but when I go back online, the file | reappears. I guess the next step will be to search my registry for | references to this file. I'm at my wit's end! | | Thanks, | Leigh | | -- | (Remove the NOT to reply by email.) | "PCR" wrote in message | ... | You are welcome. There may be manual finishing touches to perform after | a virus has been removed. Have you checked for it at your scanner's | site? Can it be as easy as...?... | | "Control Panel, Internet Options, General tab, Home Page section, Use | Default button". | | | -- | Thanks or Good Luck, | There may be humor in this post, and, | Naturally, you will not sue, | should things get worse after this, | PCR | | "Leigh" wrote in message | ... | | Thanks for all the input! I did run AdAware and Spybot along with | Norton | | Antivirus. Between the three of these, 3 viruses were detected and | some home | | page hijackers and some malware--one of which was the javaub32.exe | program. | | I'm still having problems with my homepage being hijacked but will | have to | | do some more research. The page that is loading refers to : | | res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please | let | | me know! | | | | Thanks! | | Leigh | | | | -- | | (Remove the NOT to reply by email.) | | "Leigh" wrote in message | | ... | | There is a new entry in my start-up items: Javaub32.exe. Even if I | disable | | it from starting up using a startup manager, it keeps reappearing. | If I | | disable it after starting the computer, it re-enables itself after I | open | | Internet Explorer. Any ideas what this file is? It is located in the | | Windows/System folder and has only been on my computer a few days. I | | haven't | | installed anything recently so I suppose it got there somehow while | | browsing | | the internet. I do have Adaware and Spybot installed and will try | running | | them after getting the latest updates. Just thought someone out | there | | might | | know what I'm dealing with. | | | | Thanks, | | Leigh | | | | -- | | (Remove the NOT to reply by email.) | | | | | | | | | | | | |
#10
|
|||
|
|||
Strange Behavior
Same location for me, and two entries also, but without a default page;
simply a Start Page and a Start Page_bak. http:\\www.refdesk.com is the same on both of them. -- LuckyStrike -------------------------------------------------------------------- "PCR" wrote in message ... Let me see where my home page... http://desktop.presario.net/scripts/...LC=0409&c=1c00 ... shows up... HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main Default_Page_URL "It's in a string here" Start Page "Well, it is here too" It's in that Registry key twice, & nowhere else. -- Thanks or Good Luck, There may be humor in this post, and, Naturally, you will not sue, should things get worse after this, PCR "Leigh" wrote in message ... | I've tried changing my home page but it keeps reverting back to the | res:kwreu.dll/index.html#2789 page. I have used AdAware; the program finds | the offending hijacker and removes it, but when I go back online, the file | reappears. I guess the next step will be to search my registry for | references to this file. I'm at my wit's end! | | Thanks, | Leigh | | -- | (Remove the NOT to reply by email.) | "PCR" wrote in message | ... | You are welcome. There may be manual finishing touches to perform after | a virus has been removed. Have you checked for it at your scanner's | site? Can it be as easy as...?... | | "Control Panel, Internet Options, General tab, Home Page section, Use | Default button". | | | -- | Thanks or Good Luck, | There may be humor in this post, and, | Naturally, you will not sue, | should things get worse after this, | PCR | | "Leigh" wrote in message | ... | | Thanks for all the input! I did run AdAware and Spybot along with | Norton | | Antivirus. Between the three of these, 3 viruses were detected and | some home | | page hijackers and some malware--one of which was the javaub32.exe | program. | | I'm still having problems with my homepage being hijacked but will | have to | | do some more research. The page that is loading refers to : | | res:kwreu.dll/index.html#2789. If anyone has any ideas on this, please | let | | me know! | | | | Thanks! | | Leigh | | | | -- | | (Remove the NOT to reply by email.) | | "Leigh" wrote in message | | ... | | There is a new entry in my start-up items: Javaub32.exe. Even if I | disable | | it from starting up using a startup manager, it keeps reappearing. | If I | | disable it after starting the computer, it re-enables itself after I | open | | Internet Explorer. Any ideas what this file is? It is located in the | | Windows/System folder and has only been on my computer a few days. I | | haven't | | installed anything recently so I suppose it got there somehow while | | browsing | | the internet. I do have Adaware and Spybot installed and will try | running | | them after getting the latest updates. Just thought someone out | there | | might | | know what I'm dealing with. | | | | Thanks, | | Leigh | | | | -- | | (Remove the NOT to reply by email.) | | | | | | | | | | | | |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Strange Font mix up | Peter | General | 1 | June 8th 04 03:43 PM |