mscongig startup

[Helpful person]

I have had a virus problem. My computer runing windows XP was
continuously sending emails. No viruses, worms etc were found by
Norton. (By the way, I won't use them again.)

By stopping processes one at a time I discovered the file
responsible. (fgvdte.exe). I unchecked the box in the startup tab in
msconfig, preventing it from being loaded at start up and this fixed
my problem. However, I would like to completely remove it from my
computer.

My questions are (and please bear in mind that although computer
literate I have very limited knowledge of msconfig regedit etc.)

1. The file is located in c:/windows/system32 Can I simply delete
this file or do I have to do something with the registry too.

2. How do I remove the reference to the file in the msconfig startup
tab

3. What are my risks in doing the above if I first create a system
restore point first.

www.richardfisher.com

 

[Brian A.]

**It is very important to run the update for each program before running the app/s
to be sure you have the latest definitions.**
Run the programs in Safe Mode after assuring you have shut down all running tasks
except explorer or systray and all apps are fully up to date.
Remove your Temp Internet files: Right click IE. Under the General tab click Delete
Files, put a check in Delete all Offline..., click OK and close when finished.
Delete all files in c:\windows\temp.

Download/run Cool Web Shredder from:
http://www.intermute.com/products/cwshredder.html

For Info on Cool Web Search variants:
http://www.richardthelionhearted.com/~merijn/cwschronicles.html

Download/install/run Ad-Aware SE to detect/rid of any other parasites/spyware that
may be installed. It can be obtained free from:
http://www.lavasoftusa.com/
After installing Ad-Aware, open it and click on the ref update to get the latest
up-to-date ref file, then run Ad-Aware and delete everything it finds.

Download/install/run Spybot - Search & Destroy:
http://security.kolla.de/index.php?lang=en&page=download
Run it at it's default settings until you learn an know more about it. Spybot S&D
is more of an advanced users tool and changing from the default settings can be
dangerous to the novice user. Items found in the default settings that are RED can
usually be safely removed. If you are unsure of a found item, do not remove it and
ask for help.

If you still have problems, download/run HijackThis from:
http://www.richardthelionhearted.com/~merijn/downloads.html
http://majorgeeks.com/downloads31.html

Copy HJT to it's own folder, this is where the log files will be saved. Run HJT in
Normal Mode.
Do not remove anything with it until you get advice on what to remove, HJThis will
list many apps that are needed along with the bad ones. Removing items listed
hap-hazardly without knowing what they are can/will create a royal mess. Read the
quick start here on how to create a log file that can be copied/pasted into a forum
that can provide assistance on removal of unwanted pests.
http://mjc1.com/mirror/hjt/#quick

Then post the logs to an appropriate forum where they specialize in
spyware/hijacker removal. Please read any sticky notes for proper posting which are
most commonly posted first at the top in each specific forum. Read any information
under each forum category name for information on what that particular one is used
for, look for the proper one that you post logs to.
http://forums.spywareinfo.com/
http://aumha.net/
http://forum.aumha.org/

After running the above and assuring you have a clean machine:
It’s also a good idea to have a HOSTS file to block bad sites, scroll to HOSTS File
Manager here:
http://www.mvps.org/PracticallyNerded/Software.htm

Download/install/run SpywareBlaster which stops the bad boys before they even get a
chance to install:
http://www.javacoolsoftware.com/spywareblaster.html

--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375

 

[Helpful person]

**It is very important to run the update for each program before running the app/s
to be sure you have the latest definitions.**
Run the programs in Safe Mode after assuring you have shut down all running tasks
except explorer or systray and all apps are fully up to date.
Remove your Temp Internet files: Right click IE. Under the General tab click Delete
Files, put a check in Delete all Offline..., click OK and close when finished.
Delete all files in c:\windows\temp.

Download/run Cool Web Shredder from:http://www.intermute.com/products/cwshredder.html

For Info on Cool Web Search variants:http://www.richardthelionhearted.com/~merijn/cwschronicles.html

Download/install/run Ad-Aware SE to detect/rid of any other parasites/spyware that
may be installed. It can be obtained free from:http://www.lavasoftusa.com/
After installing Ad-Aware, open it and click on the ref update to get the latest
up-to-date ref file, then run Ad-Aware and delete everything it finds.

Download/install/run Spybot - Search & Destroy:http://security.kolla.de/index.php?lang=en&page=download
Run it at it's default settings until you learn an know more about it. Spybot S&D
is more of an advanced users tool and changing from the default settings can be
dangerous to the novice user. Items found in the default settings that are RED can
usually be safely removed. If you are unsure of a found item, do not remove it and
ask for help.

If you still have problems, download/run HijackThis from:http://www.richardthelionhearted.com/~merijn/downloads.htmlhttp://majorgeeks.com/downloads31.html

Copy HJT to it's own folder, this is where the log files will be saved. Run HJT in
Normal Mode.
Do not remove anything with it until you get advice on what to remove, HJThis will
list many apps that are needed along with the bad ones. Removing items listed
hap-hazardly without knowing what they are can/will create a royal mess. Read the
quick start here on how to create a log file that can be copied/pasted into a forum
that can provide assistance on removal of unwanted pests.http://mjc1.com/mirror/hjt/#quick

Then post the logs to an appropriate forum where they specialize in
spyware/hijacker removal. Please read any sticky notes for proper posting which are
most commonly posted first at the top in each specific forum. Read any information
under each forum category name for information on what that particular one is used
for, look for the proper one that you post logs to.http://forums.spywareinfo.com/http://aumha.net/http://forum.aumha.org/

After running the above and assuring you have a clean machine:
It's also a good idea to have a HOSTS file to block bad sites, scroll to HOSTS File
Manager here:http://www.mvps.org/PracticallyNerded/Software.htm

Download/install/run SpywareBlaster which stops the bad boys before they even get a
chance to install:http://www.javacoolsoftware.com/spywareblaster.html

--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375












- Show quoted text -

Thanks for the detailed reply. However, it does not answer my
questions. (Note that I no longer have a problem, just wish to remove
the offending links and files.)

www.richardfisher.com

 

[db]

yeh, you can delete it or change it
file name to something ending with
..tmp

if deleted then it will go to the
recycle bin.

if it is running, you won't have access
to it so you might want to remove
or modify it in safemode.

since it is an exe file in the system
folder, i don't think there is a sibling
folder in program files. but if there
is then i would delete that folder too.

later you can run a registry cleaner
like eusing to remove any residual
keys associated with that program.

then later you can also run
http://www.get-in-control.com/msconfig-cleanup/

i simply delete or rename the file first
and wait a couple of days before cleaning
the o.s. to ensure it
didn't root itself deeper into the o.s.

- db
I have had a virus problem. My computer runing windows XP was
continuously sending emails. No viruses, worms etc were found by
Norton. (By the way, I won't use them again.)

By stopping processes one at a time I discovered the file
responsible. (fgvdte.exe). I unchecked the box in the startup tab in
msconfig, preventing it from being loaded at start up and this fixed
my problem. However, I would like to completely remove it from my
computer.

My questions are (and please bear in mind that although computer
literate I have very limited knowledge of msconfig regedit etc.)

1. The file is located in c:/windows/system32 Can I simply delete
this file or do I have to do something with the registry too.

2. How do I remove the reference to the file in the msconfig startup
tab

3. What are my risks in doing the above if I first create a system
restore point first.

www.richardfisher.com

 

[Poprivet]

Please follow Brian's very good advice. Your computer has been "zombied",
or in other words, been infected with malware that sends out spams or
whatever for someone else's personal gain. You might also want to alert
your ISP to this so that if/when you are reported for spamming, your account
won't be automatically shut down on you. An ounce of prevention ... type of
thing.
It's highly likely that simply removing the file you've discovered will
stop it for long. There is a controlling program hidden somewhere that will
simply re-create the files it needs. Also there may be more than the one
file you discovered on your own.
Once a machine has become a zombie, it's basically under control of the
spammers. You WILL eventually be reported for spamming, and lose access to
your accounts if you don't get it stopped for good.

Don't feel bad; you're among a large number of people infected this way.
The best protection for the future is to install a firewall and malware
detectors. ZoneAlarm is a good firewall and it's free. Also easy to use.
At first it's a pain "allowing" accesses to happen, but you only have to
give permission for something one time; after that the program remembers
that particular event and won't ask you again. In a day or so you'll be all
set.

If this hasn't taken care of your questions, come on back and we'll try
again.

See a couple of inline comments below:

I have had a virus problem. My computer runing windows XP was
continuously sending emails. No viruses, worms etc were found by
Norton. (By the way, I won't use them again.)

Good, but ... Norton only looks for certain things. To protect against
malware, you also need an arsenal of anti-malware tools like Adaware,
Sypbot, WinPatrol and so on. NO single program will catch all of them, but
together they make a pretty strong defense. ALWAYS update them often; new
exploits are discovered daily. I update mine before I run each one.

By stopping processes one at a time I discovered the file
responsible. (fgvdte.exe). I unchecked the box in the startup tab in
msconfig, preventing it from being loaded at start up and this fixed
my problem. However, I would like to completely remove it from my
computer.

You could just delete it, but as I said above, there may be other files
hidden around the disk, and even registry entries that were made. You won't
be able to locate all the culprits, or maybe even no further culprits on
your own; that's where advice like Brian gave is the right path to follow.

My questions are (and please bear in mind that although computer
literate I have very limited knowledge of msconfig regedit etc.)

1. The file is located in c:/windows/system32 Can I simply delete
this file or do I have to do something with the registry too.

You could try it from Safe Mode and, faling success there, go to the Command
Prompt to delete it. More than likely though you're going to need the
assistance of some malware to eradicate it completely.

2. How do I remove the reference to the file in the msconfig startup
tab

When it's been removed from the computer it will no longer show up there.

3. What are my risks in doing the above if I first create a system
restore point first.

Probably very small risks unless you remove a system file. The key word
there is "probably".
To get a reasonable protection level, you need, in addition to Norton, at
least three anti-spyware programs and a firewall such as ZA.

If you do seem to be able to fix this youself, then congrats. BUT ... keep
a close eye on things for the next few weeks. If your machine has been
compromised and turned itno a zombie, I suspect the following is true:
-- a spammer has access to your machine anytime you are online.
-- the malware you now have might either rebuild and reinstall itself
unbeknownst to you, or the spammer may even be checking the health of his
malware and making updates to it.
Brian's advice, malware detectors, and a firewall can seal that up. Let
me make that stronger: They WILL seal that up, unless you somehow
inadvertantly ask for the malware to be downloaded. Don't laugh; there are
some pretty smart folk out there who can make it sound good, but then,
besides what you think you're downloading, there's also a good payload of
malware that you neved even notice!

Some of these are old, but they're still relevant:
http://ezinearticles.com/?Is-Your-PC-Part-of-a-Zombie-Army-Unit-Without-You-Knowing-It?&id=392751
http://news.bbc.co.uk/1/hi/programmes/click_online/3618944.stm
http://www.castlecops.com/modules.php?name=News&file=print&sid=3164
http://www.pcworld.com/article/id,50084-page,1/article.html


HTH
Pop`

 

[Helpful person]

Please follow Brian's very good advice. Your computer has been "zombied",
or in other words, been infected with malware that sends out spams or
whatever for someone else's personal gain. You might also want to alert
your ISP to this so that if/when you are reported for spamming, your account
won't be automatically shut down on you. An ounce of prevention ... type of
thing.
It's highly likely that simply removing the file you've discovered will
stop it for long. There is a controlling program hidden somewhere that will
simply re-create the files it needs. Also there may be more than the one
file you discovered on your own.
Once a machine has become a zombie, it's basically under control of the
spammers. You WILL eventually be reported for spamming, and lose access to
your accounts if you don't get it stopped for good.

Don't feel bad; you're among a large number of people infected this way.
The best protection for the future is to install a firewall and malware
detectors. ZoneAlarm is a good firewall and it's free. Also easy to use.
At first it's a pain "allowing" accesses to happen, but you only have to
give permission for something one time; after that the program remembers
that particular event and won't ask you again. In a day or so you'll be all
set.

If this hasn't taken care of your questions, come on back and we'll try
again.

See a couple of inline comments below:



Good, but ... Norton only looks for certain things. To protect against
malware, you also need an arsenal of anti-malware tools like Adaware,
Sypbot, WinPatrol and so on. NO single program will catch all of them, but
together they make a pretty strong defense. ALWAYS update them often; new
exploits are discovered daily. I update mine before I run each one.




You could just delete it, but as I said above, there may be other files
hidden around the disk, and even registry entries that were made. You won't
be able to locate all the culprits, or maybe even no further culprits on
your own; that's where advice like Brian gave is the right path to follow.





You could try it from Safe Mode and, faling success there, go to the Command
Prompt to delete it. More than likely though you're going to need the
assistance of some malware to eradicate it completely.




When it's been removed from the computer it will no longer show up there.




Probably very small risks unless you remove a system file. The key word
there is "probably".



To get a reasonable protection level, you need, in addition to Norton, at
least three anti-spyware programs and a firewall such as ZA.

If you do seem to be able to fix this youself, then congrats. BUT ... keep
a close eye on things for the next few weeks. If your machine has been
compromised and turned itno a zombie, I suspect the following is true:
-- a spammer has access to your machine anytime you are online.
-- the malware you now have might either rebuild and reinstall itself
unbeknownst to you, or the spammer may even be checking the health of his
malware and making updates to it.
Brian's advice, malware detectors, and a firewall can seal that up. Let
me make that stronger: They WILL seal that up, unless you somehow
inadvertantly ask for the malware to be downloaded. Don't laugh; there are
some pretty smart folk out there who can make it sound good, but then,
besides what you think you're downloading, there's also a good payload of
malware that you neved even notice!

Some of these are old, but they're still relevant:http://ezinearticles.com/?Is-Your-P...orld.com/article/id,50084-page,1/article.html

HTH
Pop`

Thank you for your excellent advice. However, I have been quite
vigilant with protecting the machine with firewall and adware
protection. As this is my daughter's machine I suspect that she
inadvertantly allowed the virus in.

This machine reaches through the internet through a wireless
connection. It is supposed to be set up so that it's address is
hidden from the internet. If this is true then I suspect that I will
probably be safe. However I will keep a close eye on it.

www.richardfisher.com

 

[Brian A.]

You do that by following the steps suggested.

Sure you can, but that is no guarantee you're system will be clean especially if
deleting the file in question is backed up by another file named differently that
executes if the file is deleted.

In the registry RUN key which will not guarantee the system is clean.

Creating a Restore point that includes the virus that will be reinstalled when that
restore point is used.

Thanks for the detailed reply. However, it does not answer my
questions. (Note that I no longer have a problem, just wish to remove
the offending links and files.)

It does answer your questions if you want to make sure you get it and with any
files that are part of it, and any others that may be sitting in wait running in
Stealth Mode.


--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375

 

[Brian A.]

Thank you for your excellent advice. However, I have been quite
vigilant with protecting the machine with firewall and adware
protection. As this is my daughter's machine I suspect that she
inadvertantly allowed the virus in.

It doesn't matter how vigilant anyone is, any "NEW" virus that has yet to be
detected basically has free reign until it's become known and the proper definition
files can be written and added to an AV database.

This machine reaches through the internet through a wireless
connection. It is supposed to be set up so that it's address is
hidden from the internet. If this is true then I suspect that I will
probably be safe. However I will keep a close eye on it.

Good luck with that, any good hacker with the proper equipment and knowledge that's
within 300 ft of the router has a good probability of getting into the network.


--

Brian A. Sesko { MS MVP_Shell/User }
Conflicts start where information lacks.
http://basconotw.mvps.org/

Suggested posting do's/don'ts: http://www.dts-l.org/goodpost.htm
How to ask a question: http://support.microsoft.com/kb/555375

 

[PA Bear]

Do you have an anti-virus application installed? Are its definitions
up-to-date?

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.