pop-up

[Guest]

hi, for the last 3 days, everytime I boot up, I get a pop-up asking me to
run/cancel "ValueSoft.exe".
I have no idea what this is or where it came from. A virus scan shows no
problems, but when I click "cancel" the pop up goes, but returns at next boot
up. Can anyone tell me what this is?
Thanks--
Andrew

 

[Newbie Coder]

Andrew,

Download & run this:

http://www.microsoft.com/technet/sysinternals/utilities/autoruns.mspx

Look in the LOGON tab & see if you can see the ValueSoft.exe

Next, note the location of it

Click CTRL + ALT + DEL & END TASK it

Naviage to where the file is & delete it, but first right-click | Properties
& see if it has a digital signature or a company name listed

Go back to the LOGON tab & delete the entry pointing to the ValueSoft.exe

-----------------------

Also, before you END TASK that process you can download & run this:

http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx

Double-click the ValueSoft.exe file, click the Strings tab & look for
websites etc or messages you are receiving

 

[Newbie Coder]

Andrew,

I forgot to mention

Download & install Spybot S & D

http://www.spybot.info

Backup the registry, install the updates & scan the computer. Any red
entries - delete them

 

[PA Bear]

Run a /thorough/ check for hijackware, including posting your hijackthis log
to an appropriate forum.

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine2.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.org/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware with
assistance from an expert. **Post your log to
http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

If the procedures look too complex - and there is no shame in admitting this
isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.