A funny file that i cant get rid of

[Guest]

I have a file that continues to run named aceula.exe. I says that it is starting from \winnt\fonts. Everytime I delete it, it immediately returns. Running a search for this file comes up empty. Any ideas? It will not go away, ad is causing IE crashes and lockups. Thanks.

 

[George Hester]

ace(nd)u(ser)l(icense)a(greement).exe Hmmm....

Can you ever find it? Do you see it in the Task Manager? If you fire up IE first then look do you find it? Look in C:\WINNT\system32

 

[Guest]

I did finally find it. It is an exe file that resides in winnt\fonts. I cant delete it even in safe mode. It does show up in task manager when the mahine is booted regularly. When I attempt to end task, it immediately returns. How can I go in and find out where this file is runing and how can I delete it? Thanks!!

 

[Guest]

sounds like a nasty virus to me - we had one a while back opaserv.worm which was made up of several files. As soon as you deleted one it would get reintalled by either another computer on the network or by one of the other files on the pc. Do a search on the symantec website for the file name and see what comes up - you may even find a virus removal tool

 

[George Hester]

Well it is running in the fonts folder it seems. You probably meant where do I find out where it is called. There are a number of good applications that may help you to find where it is called. They are:

AdAware 6
HijackThis
BHODemon
CWShredder

Look in http://www.google.com
But you will probably find its call in the registry under these keys:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Other place to look is your Startup folders off programs off the Start button (all profiles).

--
George Hester
__________________________________

I did finally find it. It is an exe file that resides in winnt\fonts. I cant delete it even in safe mode. It does show up in task manager when the mahine is booted regularly. When I attempt to end task, it immediately returns. How can I go in and find out where this file is runing and how can I delete it? Thanks!!