Question On Program In Prefetch File

[Pike]

Hi,

I was fixing to do an online spyware scan and my firewall told me that this
program was trying to excess the internet, so, I blocked it not knowing what
it was.
I looked for it with search and it is located in my windows prefech file. I
wonder if anyone knows what it is, as I tried to do a MS and Google search
and came up empty.
It is called "SpSubrx.exe-21392513.pf".

Thanks for any help.

Pike

 

[Wesley Vogel]

A Google search for SpSubrx.exe brings up nothing which usually indicates
some form of malware. Or you typed it incorrectly.

SpSubrx.exe-21392513.pf means that SpSubrx.exe has run at least once on your
machine.

..pf files are used to defrag the hard drive so other files load faster.

If SpSubrx.exe does not exist on your machine you may be ok. The
SpSubrx.exe-21392513.pf is not dangerous and can be deleted. If it returns
that means that SpSubrx.exe has started again.

HOW TO: Search For Hidden Or System Files In Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;302347

Update your antivirus software and run a full system scan.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Rick \Nutcase\ Rogers]

Hi,

First, the prefetch file is not the problem. The .pf files just contain
information about files recently in use by the system. I would concentrate
more on the SpSubrx.exe file that it is referring to, as that is likely a
trojan that you really don't want on the system.

Free virus removal tools:

http://vil.nai.com/vil/stinger/
http://www.emsisoft.com/en/
http://free.grisoft.com/doc/8/lng/us/tpl/v5/nid/3001#3001
http://www.f-secure.com/download-purchase/tools.shtml

Also, you may use this free on-line scanner:
http://housecall.trendmicro.com/

Symantec also distributes many free removal tools that are virus-specific:
http://securityresponse.symantec.com/avcenter/tools.list.html

Many are best run in Safe mode to minimize interference. Most will resist
removal in normal mode where they are active.

How to start in Safe mode:
http://www.rickrogers.org/fixes.htm#Safe mode

Emergency system tools:
http://www.dougknox.com/xp/utils/xp_emerutils.htm

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org

 

[Pike]

Thanks to both of you for answering so quickly. I will do as suggested and
should I discover what the file actually was, will let you know.

Pike

 

[Guest]

Subrx= subroutine, only thing on "Sp" was here:
http://www.jclark.com/sp/
Using OpenOffice or similar?

 

[Pike]

Hey Guys, I found it by going to my firewall log and see what it said and
it said it was located in the windows/download file. It was a java browser
helper that Housecall was installing and it became damaged it says it is
damaged. I suppose because I blocked it.

Thanks for your help. I have bookmarked the links for use later.

Pike

 

[Pike]

Subrx= subroutine, only thing on "Sp" was here:
http://www.jclark.com/sp/
Using OpenOffice or similar?

Wow, you found something. I have since found the answer, which I have
posted. However, I appreciate you locating this. I would like to read up
abit on this.


Folks are so helpful in these newsgroup. From day one I have learned more
about my computer from MS newsgroups than anywhere else.
I save information I think might be useful later,

I salute all of you for your time and effort in helping.

Pike

 

[Guest]

Further search, on SpSub does mention Java, among other things.