Ner0Check.exe

  • Thread starter Thread starter Sinus Logarithme
  • Start date Start date
S

Sinus Logarithme

Is Ner0Check.exe a legitimate file ? (not Nerocheck.exe)
It's in \winnt\system32, hidden, and it runs at startup (a tsr).
 
In Sinus Logarithme <[email protected]> had this to say:

My reply is at the bottom of your sent message:
Is Ner0Check.exe a legitimate file ? (not Nerocheck.exe)
It's in \winnt\system32, hidden, and it runs at startup (a tsr).
Click to expand...

If you mean nerocheck.exe (with the letter and not the number) then yes.
It's legit. It's a Nero file, do you have Nero installed?

Galen
 
I never installed Nero in that machine. In fact, I formatted the disk a few
days ago. And it's not the letter o, but zeo.
 
In Sinus Logarithme <[email protected]> had this to say:

My reply is at the bottom of your sent message:
I never installed Nero in that machine. In fact, I formatted the disk
a few days ago. And it's not the letter o, but zeo.
Click to expand...

Google gives no hits, it's time for a malware scan methinks. Update and scan
your drive(s) for trojans, viruses, spyware, adware, malware, and joke
programs I would guess. That would be the next logical step.

Galen
 
From: "Sinus Logarithme" <[email protected]>

| Is Ner0Check.exe a legitimate file ? (not Nerocheck.exe)
| It's in \winnt\system32, hidden, and it runs at startup (a tsr).
|



Dump the contents of the IE Temporary Internet Folder cache (TIF)

start --> settings --> control panel --> internet options --> delete files

1) Download the following four items...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Ad-aware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt488.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Ad-aware with the latest definitions.
3) Reboot your PC into Safe Mode and shutdown as many applications as possible
5) Using Trend Sysclean, Stinger and Ad-aware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using the three
utilities; Trend Sysclean, Stinger and Ad-aware

* * Please report your results ! * *
 
I followed your instructions, except for (6).
AdAware found 2 references to Alexa and a couple of f...-cookies
Stinger didn't find a thing.
Sysclean didn't find a thing, but complained about not beeing able to read
14 files. So I:
- booted from a diskette and copied these files somewhere else
- rebooted in safe mode and scanned the 14 files with sysclean
No viruses found.

Ner0Check.exe was never mentioned.
BUT ner0check.exe doesn't load anymore, even though I started all (at least,
I think) the programs I've used these few days, just to see.
Finally, I removed it from the registry and renamed the file *.??

Thank you very much for your help. Thank you also to the others who replied
to my message.
 
Back
Top