ACUTIL.EXE

What is Acutil.exe??? When I run msconfig, I uncheck the
box, then the computer restarts. When it restarts, the
box is checked again.

I tried regedit, ctrl+f of acutil, deleted them from
there. Then went to Windows Explorer. The application
file is located as follows:
C:\WINDOWS\WEB\ACUTIL.EXE

I cannot delete the program because it states that it is
being used. However, when I ctrl+alt+del, it is not
running.

I give??? Please help. Thank you.

Ctrl-Alt-Del does not show all running processes especially those that don't
want themselves to be seen such as malware and I suspect that acutil.exe is
just that, malware.

Boot to Safe Mode and see if you can rename the file as hopefully it will not
have been launched in Safe Mode. Select and right click on the file and check
the Version tab on its Properties sheet. Does this tell you anything about
its origin such as company, version and date.

This might be a good time to download yourself a copy of the free Ad-Aware 6.0
from Lavasoft (http://www.lavasoftusa.com/software/adaware/) and also SpyBot
Search & Destroy (http://www.safer-networking.org/) and use them to check your
system for other commercial parasites remembering that they are only as good
as when you last updated their reference files. I also use a program called
BHODemon (http://www.definitivesolutions.com/bhodemon.htm that checks for
unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html) which can help prevent
some parasites getting a grip on your PC.

Just is case the problem is due to a new version of the CoolWebSearch parasite
you might want to download and run the CWShredder which targets that specific
parasite. Unfortunately neither AdAware or SpyBot seem to be able as yet to
fully detect all the various versions of the CoolWebSearch parasite as it
keeps changing. For more details of the CoolWebSearch parasite see
http://www.spywareinfo.com/~merijn/cwschronicles.html.

CWShredder, merijn's removal tool, can be downloaded from either:
http://www.zerosrealm.com/downloads/CWShredder.zip
or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Finally if you still continue to experience problems download a copy of
HijackThis from (http://www.spywareinfo.com/~merijn/downloads.html). Create a
folder called hijackthis on C: and copy the file you downloaded to that
folder. Close as many applications as you can including all instances of
Internet Explorer and then run hijackthis.exe and post back the log, provided
that it isn't too long, to this thread, otherwise to the HijackThis Forum at
http://www.spywareinfo.com/forums/ and hopefully this will enable someone to
identify the cause of your problem.
--?
Mike Maltby MS-MVP



wrote:

What is Acutil.exe??? When I run msconfig, I uncheck the
box, then the computer restarts. When it restarts, the
box is checked again.

I tried regedit, ctrl+f of acutil, deleted them from
there. Then went to Windows Explorer. The application
file is located as follows:
C:\WINDOWS\WEB\ACUTIL.EXE

I cannot delete the program because it states that it is
being used. However, when I ctrl+alt+del, it is not
running.

I give??? Please help. Thank you.

Mike,
=20
Thank you so much for the info. The thought to start=20
in safe mode never crossed my mind. I did this and was=20
able to delete it from the system. Also, thanks for the=20
Ad-Aware/Spybot info. Question, I thought these software=20
would slow the system down. Any truth to that???



-----Original Message-----
Ctrl-Alt-Del does not show all running processes=20
especially those that don't=20
want themselves to be seen such as malware and I suspect=20
that acutil.exe is=20
just that, malware.

Boot to Safe Mode and see if you can rename the file as=20
hopefully it will not=20
have been launched in Safe Mode. Select and right click=20
on the file and check=20
the Version tab on its Properties sheet. Does this tell=20
you anything about=20
its origin such as company, version and date.

This might be a good time to download yourself a copy of=20
the free Ad-Aware 6.0
from Lavasoft=20
(http://www.lavasoftusa.com/software/adaware/) and also=20
SpyBot
Search & Destroy (http://www.safer-networking.org/) and=20
use them to check your
system for other commercial parasites remembering that=20
they are only as good
as when you last updated their reference files. I also=20
use a program called
BHODemon (http://www.definitivesolutions.com/bhodemon.htm=20
that checks for
unwanted Browser Help Objects and SpywareBlaster
(http://www.wilderssecurity.net/spywareblaster.html)=20
which can help prevent
some parasites getting a grip on your PC.

Just is case the problem is due to a new version of the=20
CoolWebSearch parasite
you might want to download and run the CWShredder which=20
targets that specific
parasite. Unfortunately neither AdAware or SpyBot seem to=20
be able as yet to
fully detect all the various versions of the=20
CoolWebSearch parasite as it
keeps changing. For more details of the CoolWebSearch=20
parasite see
http://www.spywareinfo.com/~merijn/cwschronicles.html.

CWShredder, merijn's removal tool, can be downloaded from=20
either:
http://www.zerosrealm.com/downloads/CWShredder.zip
or
http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Finally if you still continue to experience problems=20
download a copy of
HijackThis from=20
(http://www.spywareinfo.com/~merijn/downloads.html). =20
Create a
folder called hijackthis on C: and copy the file you=20
downloaded to that
folder. Close as many applications as you can including=20
all instances of
Internet Explorer and then run hijackthis.exe and post=20
back the log, provided
that it isn't too long, to this thread, otherwise to the=20
HijackThis Forum at
http://www.spywareinfo.com/forums/ and hopefully this=20
will enable someone to
identify the cause of your problem.
--=81
Mike Maltby MS-MVP



=20
wrote:

What is Acutil.exe??? When I run msconfig, I uncheck=20
the
box, then the computer restarts. When it restarts, the
box is checked again.

I tried regedit, ctrl+f of acutil, deleted them from
there. Then went to Windows Explorer. The application
file is located as follows:
C:\WINDOWS\WEB\ACUTIL.EXE

I cannot delete the program because it states that it is
being used. However, when I ctrl+alt+del, it is not
running.

I give??? Please help. Thank you.=20

.

wrote:

Thank you so much for the info. The thought to start
in safe mode never crossed my mind. I did this and was
able to delete it from the system. Also, thanks for the
Ad-Aware/Spybot info. Question, I thought these software
would slow the system down. Any truth to that???

I'm glad to read you've managed to get rid of acutil.exe but can't help but
wonder what it was.

Not certain that I understand what you mean. AdAware and SpyBot are tools
used to clean your PC and not applications that you leave running all the time
like say an antivirus application or software firewall. The same goes for the
other items I mentioned.

Regards,
--
Mike Maltby MS-MVP