How do I remove this?!

[Guest]

With no programs open I have over 40 processes running. I try to end some but they simply reappear. It is always replaced by one of like 4-5 different processes that cycle. For example, right now I have Nnn191N.exe running. I try to stop the process and it gets immediatly replaced by Wfe5HV5.exe. They also use up anywher from 3 to 5 CPU cycles. I've tried several programs that are suppose to let me remove them but to no avail. Please help!

 

[Dave Patrick]

You'll first need to stop the process that loads them. Look for something
suspicious here. Natively you can; Start\Settings\Control
Panel\Administrative Tools\Computer Management(Local)\System
Information\Software Environment\Startup Programs|View|Advanced, then in the
"Location" column, you'll find the path to the "Startup" location either in
the "Startup" directories or from the registry's "Run" keys.

%ALLUSERSPROFILE%\Start Menu\Programs\Startup
%USERPROFILE%\Start Menu\Programs\Startup

You can delete the shortcuts that you no longer want to run.


HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

You can delete the string value for the program you no longer want to run.

or copy msconfig from Windows XP


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| With no programs open I have over 40 processes running. I try to end some
but they simply reappear. It is always replaced by one of like 4-5 different
processes that cycle. For example, right now I have Nnn191N.exe running. I
try to stop the process and it gets immediatly replaced by Wfe5HV5.exe. They
also use up anywher from 3 to 5 CPU cycles. I've tried several programs that
are suppose to let me remove them but to no avail. Please help!

 

[Guest]

----- Dave Patrick wrote: -----

You'll first need to stop the process that loads them. Look for something
suspicious here. Natively you can; Start\Settings\Control
Panel\Administrative Tools\Computer Management(Local)\System
Information\Software Environment\Startup Programs|View|Advanced, then in the
"Location" column, you'll find the path to the "Startup" location either in
the "Startup" directories or from the registry's "Run" keys.

%ALLUSERSPROFILE%\Start Menu\Programs\Startup
%USERPROFILE%\Start Menu\Programs\Startup

You can delete the shortcuts that you no longer want to run.


HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

You can delete the string value for the program you no longer want to run.

or copy msconfig from Windows XP

I was able to follow you till you talked about deleting the shortcut since I'm not sure how to do that. I did have a friend send me msconfig but it didn't help. The moment I tried to remove the process it was replaced with another.

 

[DL]

If using msconfig to stop the proccess, and it is immediately replaced with
a new proccess then it is highly likely you have some mal/adaware junk
installed or an application you have installed is configured to restart
itself eg Real has this habit. You could allways search for the exe, to see
if its location gives a clue, and examine its properties
Assuming you have a current AV app, and Firewall installed try downloading
then updating Adaware and SpyBot.

----- Dave Patrick wrote: -----

You'll first need to stop the process that loads them. Look for something
suspicious here. Natively you can; Start\Settings\Control
Panel\Administrative Tools\Computer Management(Local)\System
Information\Software Environment\Startup Programs|View|Advanced, then in the
"Location" column, you'll find the path to the "Startup" location either in
the "Startup" directories or from the registry's "Run" keys.

%ALLUSERSPROFILE%\Start Menu\Programs\Startup
%USERPROFILE%\Start Menu\Programs\Startup

You can delete the shortcuts that you no longer want to run.


HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

You can delete the string value for the program you no longer want to run.

or copy msconfig from Windows XP

I was able to follow you till you talked about deleting the shortcut since

I'm not sure how to do that. I did have a friend send me msconfig but it
didn't help. The moment I tried to remove the process it was replaced with
another.

 

[Dave Patrick]

I would have guessed the source to be in one of the registry "Run" keys. If
you found the source to be a shortcut then just search the drive for it. It
is most likely in one of the startup directories.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| I was able to follow you till you talked about deleting the shortcut since
I'm not sure how to do that. I did have a friend send me msconfig but it
didn't help. The moment I tried to remove the process it was replaced with
another.
|

 

[DaveK]

I had the same problem. Spybot took care of this for me
but it took some detailed examination of the registry and
several attempts. If you are hesitant about deleteing
some programs, you can always rename them before hitting
the delete button. The question is, where/how did you get
infected? For me, it was in downloading some "free" web
page templates. Beware of "free" stuff, it can be tied
into mal-ware. The anti-virus software often does not see
these things as viruses for some reason.