Unknown exe's

[TDP]

Hi, I have just been clearing up my son's pc and got rid of a lot of
spy/malware there are two exe's that are in the processes and am
concerned,they do not appear when I do a full search for them though,they
are: "msxcrap.exe" (yes it does say that!!) and "mshvc.exe"
I have googled and M$ knowledge based but with no luck.
Can anyone tell me anything please (I have run an up to date McAfee scan and
Adaware and Spybot S&D). TDP.

 

[Pop]

I don't think either of those are MS files. If you're nervous
about deleting them, either copy them to a floppy or CD or
somewhere else on the drive, and/or rename them. For example
msxxx.exe becomes msxxx.OLD.
continue to let the computer run and see if any problems
develop. If no problems come up in a week of so or normal use,
delete the renamed files. I doubt you'll ever miss them.
Perhaps the kids renamed some other file to that name? You can
look at them with Notepad and see what they look like; they can't
execute from within Notepad.

Pop

 

[plls5]

Those are pretty good. Nothing shows up anywhere. However, doing a search
on "xcrap" brings up a few items in Google. These show up in Task Manager?

 

[Ramesh, MS-MVP]

Hi TDP,

Eliminate the malware completely.

The Parasite Fight - Quick Fix Protocol:
http://aumha.org/a/quickfix.php

 

[Kelly]

Hi,

Are these the correct spellings?

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com

 

[TDP]

Hi Yes I made sure of that, I have done a search for these exe's and cannot
find them on the pc only in "processes"
Thanks TDP.

 

[Kelly]

Thanks for the reply.

There is a moscrop:
http://www.google.com/search?hl=en&c2coff=1&q=moscrop&spell=1

Either way, check Services: Start/Run/gpedit.msc and your runkeys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Also: Under Software:

HKEY_CURRENT_USER\Software
HKEY_LOCAL_MACHINE\SOFTWARE

And while there: Edit/Find

Also, run this combo, updated!

Run Ad-Aware SE, Spybot and HijackThis:
http://www.majorgeeks.com/downloads31.html

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Good luck and keep us posted!

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com