"New Hot Deals.exe" keeps showing up on my Desktop, how to get rid of it????

[niteowl]

Hi all,

I working on my father-in-laws' Windows XP Home computer, just ran
Spybot Search & Destroy 1.3 with all updates, Adaware (latest free
version with updates), the latest McAFee's Stinger.exe, and just
installed Norton's 2003 and ran it - Norton's came up clean. Spybot
found 63 files that it removed, Stinger found 72 infected files,
mostly the W32/Zafi.b@mm (I think that was it) and the Adaware found
about 57 entries that were removed.

on bootup the very last thing to happen is a file appears on the
deskop named "New Hot Deals.exe" and I've tried deleting it several
times, but on each reboot it comes back.

I checked the properties of the file, but can not determine where it's
coming from. I tried getting into the place where the list of startup
stuff is located but can't remember for sure where it is.. I'm more
used to win98, the XP is pretty new to me.

Can someone tell me how to trace this thing so I can get rid of it?

thanks,
niteowl

 

[Ramesh [MVP]]

Hi Niteowl,

It's not a standard item, but an add-on comes with HP/Compaq systems. Open Services.msc applet and disable the service "msCMTSrvc" Content Monitoring Tool Service (CMTS) and set it's status to disabled. Reboot and delete the Hot Deals icon in the Desktop. For more information, contact the PC manufacturer.

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://www.mvps.org/sramesh2k

Windows 2000 Group Policy Registry Table:
http://www.microsoft.com/windows2000/techinfo/reskit/en-us/gp/gpref.asp

Hi all,

I working on my father-in-laws' Windows XP Home computer, just ran
Spybot Search & Destroy 1.3 with all updates, Adaware (latest free
version with updates), the latest McAFee's Stinger.exe, and just
installed Norton's 2003 and ran it - Norton's came up clean. Spybot
found 63 files that it removed, Stinger found 72 infected files,
mostly the W32/Zafi.b@mm (I think that was it) and the Adaware found
about 57 entries that were removed.

on bootup the very last thing to happen is a file appears on the
deskop named "New Hot Deals.exe" and I've tried deleting it several
times, but on each reboot it comes back.

I checked the properties of the file, but can not determine where it's
coming from. I tried getting into the place where the list of startup
stuff is located but can't remember for sure where it is.. I'm more
used to win98, the XP is pretty new to me.

Can someone tell me how to trace this thing so I can get rid of it?

thanks,
niteowl

 

[Kelly]

From a previous post:

This happened to me on a Compaq when I tried to delete the "Compaq Hot
Deals" icon. "Trojan downloader.presario.A" had been detected in
C:\windows\system32\mscmtsrvc.exe."

According to Compaq Support -
http://h10025.www1.hp.com/ewfrf/wc/genericDocument?lc=en&cc=us&docname=bpb11751
seems "msCMTSrvc.exe is an application that was installed on the computer by
Compaq called the Content Monitoring Tool Service (CMTS). The Compaq Offer
Zone, displayed on the desktop as the Hot Deals icon, uses the CMTS to
update the computer when new merchandise is available for purchase by the
user.

This application will not harm the computer: CMTS will attempt to
contact the Offer Zone every 10 minutes. If a firewall is installed on the
computer, this process may appear to be malicious. The firewall may warn the
user that the computer is under attack."

 

[niteowl]

I'll try this soon, but at least knowing what it is is helpful. All
the AV stuff was coming up clean, it was driving me nuts!!


Thanks,
niteowl

 

[niteowl]

thanks for the info, it's at least reassuring to know it's not a
virus.

thanks again,
niteowl

 

[niteowl]

Hi Niteowl,

Open Services.msc applet and disable the service "msCMTSrvc" Content Monitoring Tool Service (CMTS) and set it's status to disabled. Reboot and delete the Hot Deals icon in the Desktop. For more information, contact the PC manufacturer

is that on the start menu somewhere? I'm not that familiar with
XP??????

thanks,
niteowl

 

[Ramesh [MVP]]

Click Start, Run and type services.msc

--
Ramesh, Microsoft MVP
Windows XP Shell/User
http://www.mvps.org/sramesh2k

Windows 2000 Group Policy Registry Table:
http://www.microsoft.com/windows2000/techinfo/reskit/en-us/gp/gpref.asp

Hi Niteowl,

Open Services.msc applet and disable the service "msCMTSrvc" Content Monitoring Tool Service (CMTS) and set it's status to disabled. Reboot and delete the Hot Deals icon in the Desktop. For more information, contact the PC manufacturer

is that on the start menu somewhere? I'm not that familiar with
XP??????

thanks,
niteowl

 

[niteowl]

Thank You!

niteowl

 

[niteowl]

worked like a charm, thanks again...

Whatever virus I had it removed a bunch of .exe files so am
reinstalling some programs, but the system checks clean now..

defragging and it'll be ready to go back to my FIL for more abuse and
neglect. ;-)

thanks for your help!

niteowl

 

[Alexander Grigoriev]

I would classify it as sticky adware. Another reason not to buy Compaq.

 

[Ramesh [MVP]]

You're welcome

--
Ramesh, Microsoft MVP
Window XP Shell/User
http://www.mvps.org/sramesh2k


worked like a charm, thanks again...

Whatever virus I had it removed a bunch of .exe files so am
reinstalling some programs, but the system checks clean now..

defragging and it'll be ready to go back to my FIL for more abuse and
neglect. ;-)

thanks for your help!

niteowl