VSS_PS.EXE

[GEB]

Recently I've noticed that the file VSS_PS.EXE is starting on boot up. In
addition, my firewall asks whether I want the file to access the internet
(so far I've have not granted it permission). The file is located in my
c:\windows\system folder. The file was apparently created on Friday, August
17, 2001, 9:02:03 PM and is 51.3 KB (52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the internet and
if so for what purpose?

Thanks

 

[Wesley Vogel]

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a complete
scan.

 

[Heeby Jeeby]

The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
I've run Noron AV and it doesn't detect the file as a virus. Also ran
Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

 

[Wesley Vogel]

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or Home CD, I
checked both.

Returns: [[No matches found. Either the database does not contain this file,
or your search term was not appropriately entered. ]] @
DLL Help Database
http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

 

[GEB]

The file is in the C:\windows\system32 folder as is vss_ps.dll. I am
thinking that I might rename the file extension to .xxx to see what if
anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or Home CD, I
checked both.

Returns: [[No matches found. Either the database does not contain this file,
or your search term was not appropriately entered. ]] @
DLL Help Database
http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In

The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
I've run Noron AV and it doesn't detect the file as a virus. Also ran
Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

 

[GEB]

I'm running XP Home edition. Here's what I've found.

2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and the
other in the C:\windows\system32\dllcache.

I found the VSS_PS.EXE file in the C:\windows\system32 folder. I also found
a file named VSS_PS.EXE-O6AD80C2.PF in the C:\windows\prefetch folder.

I ran sfc /scannow but didn't receive any messages when the program
finished, so I assume all was OK.

The properties for the VSS_PS.EXE file shows three tabs General,
Compatability and Summary. The particulars under the General tab are as I
mentioned in my initial posting:
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB (52,625 bytes)
in size.
Compatability shows nothing checked.
Summary no details shown re the author, version number etc.

When this program tries to access the internet ZoneAlarm indicates that the
Destination IP is 206.58.237.248. This IP address appears to be nothing but
a blank page with a grey background.

I have since renamed the file to VSS_PS.XXX and have not run into any
problems with any of the programs I normally use.

A mystery to say the least.

Gerry

The file is in the C:\windows\system32 folder as is vss_ps.dll. I am
thinking that I might rename the file extension to .xxx to see what if
anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or Home CD, I
checked both.

Returns: [[No matches found. Either the database does not contain this file,
or your search term was not appropriately entered. ]] @
DLL Help Database

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In

The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
I've run Noron AV and it doesn't detect the file as a virus. Also ran
Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a
complete scan.

--
Hope this helps. Let us know.
Wes

In GEB <[email protected]> hunted and pecked:
Recently I've noticed that the file VSS_PS.EXE is starting on boot
up. In addition, my firewall asks whether I want the file to access
the internet (so far I've have not granted it permission). The file
is located in my c:\windows\system folder. The file was apparently
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB
(52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the
internet and if so for what purpose?

Thanks

 

[Wesley Vogel]

Gerry,

Changing the name was a good idea. Does it still try to access the
internet? Does it still try to start at boot? Any error messages?
Are you hungry? Just kidding.

206.58.237.248 has something to do with this site.

http://www.verio.net/

Mean anything to you?

I am very leery when an exe file has no version tab. Reeks of scumware.
Monitor it for a while and then delete VSS_PS.EXE.
If it is legit, which I doubt and you need it, you can always reinstall
whatever it was part of.

C:\windows\prefetch\VSS_PS.EXE-O6AD80C2.PF is just a file to
make VSS_PS.EXE load faster.

I would get some scumware ammo (below) if you don't have any of these
programs.

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp
--
Hope this helps. Let us know.
Wes

In

I'm running XP Home edition. Here's what I've found.

2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and
the other in the C:\windows\system32\dllcache.

I found the VSS_PS.EXE file in the C:\windows\system32 folder. I also
found a file named VSS_PS.EXE-O6AD80C2.PF in the C:\windows\prefetch
folder.

I ran sfc /scannow but didn't receive any messages when the program
finished, so I assume all was OK.

The properties for the VSS_PS.EXE file shows three tabs General,
Compatability and Summary. The particulars under the General tab are
as I mentioned in my initial posting:
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB (52,625
bytes) in size.
Compatability shows nothing checked.
Summary no details shown re the author, version number etc.

When this program tries to access the internet ZoneAlarm indicates
that the Destination IP is 206.58.237.248. This IP address appears to
be nothing but a blank page with a grey background.

I have since renamed the file to VSS_PS.XXX and have not run into any
problems with any of the programs I normally use.

A mystery to say the least.

Gerry

The file is in the C:\windows\system32 folder as is vss_ps.dll. I am
thinking that I might rename the file extension to .xxx to see what
if anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or
Home CD, I checked both.

Returns: [[No matches found. Either the database does not contain
this file, or your search term was not appropriately entered. ]] @
DLL Help Database

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In Heeby Jeeby <[email protected]> hunted and pecked:
The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
I've run Noron AV and it doesn't detect the file as a virus. Also
ran Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a
complete scan.

--
Hope this helps. Let us know.
Wes

In GEB <[email protected]> hunted and pecked:
Recently I've noticed that the file VSS_PS.EXE is starting on
boot up. In addition, my firewall asks whether I want the file
to access the internet (so far I've have not granted it
permission). The file is located in my c:\windows\system folder.
The file was apparently created on Friday, August 17, 2001,
9:02:03 PM and is 51.3 KB (52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the
internet and if so for what purpose?

Thanks

 

[GEB]

Wes, thanks for all your help and many valuable suggestions. With the
filename changed it no longer tries to access the internet. Thus far no
error messages. Verio.net means nothing to me.

Enable Install On Demand (Other) was checked and is now unchecked it (Enable
Install On Demand (Internet Explorer) was already unchecked.

Run CWShredder. Removed something called CWS.searchx

Ran the THE PARASITE FIGHT QUICK FIX PROTOCOL, no malware, dialers etc.
found
Ran SpyBot cleaned some tracking cookies.
Have downloaded and installed SpywareBlaster.
Ran Hijack This a couple of days ago.

Hopefully, I'm now about as well protected as I can be.

Again thanks for all your help.

Gerry

Gerry,

Changing the name was a good idea. Does it still try to access the
internet? Does it still try to start at boot? Any error messages?
Are you hungry? Just kidding.

206.58.237.248 has something to do with this site.

http://www.verio.net/

Mean anything to you?

I am very leery when an exe file has no version tab. Reeks of scumware.
Monitor it for a while and then delete VSS_PS.EXE.
If it is legit, which I doubt and you need it, you can always reinstall
whatever it was part of.

C:\windows\prefetch\VSS_PS.EXE-O6AD80C2.PF is just a file to
make VSS_PS.EXE load faster.

I would get some scumware ammo (below) if you don't have any of these
programs.

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp
--
Hope this helps. Let us know.
Wes

In

I'm running XP Home edition. Here's what I've found.

2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and
the other in the C:\windows\system32\dllcache.

I found the VSS_PS.EXE file in the C:\windows\system32 folder. I also
found a file named VSS_PS.EXE-O6AD80C2.PF in the C:\windows\prefetch
folder.

I ran sfc /scannow but didn't receive any messages when the program
finished, so I assume all was OK.

The properties for the VSS_PS.EXE file shows three tabs General,
Compatability and Summary. The particulars under the General tab are
as I mentioned in my initial posting:
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB (52,625
bytes) in size.
Compatability shows nothing checked.
Summary no details shown re the author, version number etc.

When this program tries to access the internet ZoneAlarm indicates
that the Destination IP is 206.58.237.248. This IP address appears to
be nothing but a blank page with a grey background.

I have since renamed the file to VSS_PS.XXX and have not run into any
problems with any of the programs I normally use.

A mystery to say the least.

Gerry

The file is in the C:\windows\system32 folder as is vss_ps.dll. I am
thinking that I might rename the file extension to .xxx to see what
if anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or
Home CD, I checked both.

Returns: [[No matches found. Either the database does not contain
this file, or your search term was not appropriately entered. ]] @
DLL Help Database

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In Heeby Jeeby <[email protected]> hunted and pecked:
The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
I've run Noron AV and it doesn't detect the file as a virus. Also
ran Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a
complete scan.

--
Hope this helps. Let us know.
Wes

In GEB <[email protected]> hunted and pecked:
Recently I've noticed that the file VSS_PS.EXE is starting on
boot up. In addition, my firewall asks whether I want the file
to access the internet (so far I've have not granted it
permission). The file is located in my c:\windows\system folder.
The file was apparently created on Friday, August 17, 2001,
9:02:03 PM and is 51.3 KB (52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the
internet and if so for what purpose?

Thanks

 

[Wesley Vogel]

Gerry.

Keep your AV and anti scumware software up to date and run them often.

--
Hope this helps. Let us know.
Wes

In

Wes, thanks for all your help and many valuable suggestions. With the
filename changed it no longer tries to access the internet. Thus far
no error messages. Verio.net means nothing to me.

Enable Install On Demand (Other) was checked and is now unchecked it
(Enable Install On Demand (Internet Explorer) was already unchecked.

Run CWShredder. Removed something called CWS.searchx

Ran the THE PARASITE FIGHT QUICK FIX PROTOCOL, no malware, dialers
etc. found
Ran SpyBot cleaned some tracking cookies.
Have downloaded and installed SpywareBlaster.
Ran Hijack This a couple of days ago.

Hopefully, I'm now about as well protected as I can be.

Again thanks for all your help.

Gerry

Gerry,

Changing the name was a good idea. Does it still try to access the
internet? Does it still try to start at boot? Any error messages?
Are you hungry? Just kidding.

206.58.237.248 has something to do with this site.

http://www.verio.net/

Mean anything to you?

I am very leery when an exe file has no version tab. Reeks of
scumware. Monitor it for a while and then delete VSS_PS.EXE.
If it is legit, which I doubt and you need it, you can always
reinstall whatever it was part of.

C:\windows\prefetch\VSS_PS.EXE-O6AD80C2.PF is just a file to
make VSS_PS.EXE load faster.

I would get some scumware ammo (below) if you don't have any of these
programs.

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page
properly or perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if
a Web page needs them in order to display the page properly or
perform a particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are
really good. Download, install, run, update and run again; one or
all. They are all good, FREE utilities.

Run CWShredder first!!! <<<<<<<<<<<<

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it
from ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp
--
Hope this helps. Let us know.
Wes

In

I'm running XP Home edition. Here's what I've found.

2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and
the other in the C:\windows\system32\dllcache.

I found the VSS_PS.EXE file in the C:\windows\system32 folder. I
also found a file named VSS_PS.EXE-O6AD80C2.PF in the
C:\windows\prefetch folder.

I ran sfc /scannow but didn't receive any messages when the program
finished, so I assume all was OK.

The properties for the VSS_PS.EXE file shows three tabs General,
Compatability and Summary. The particulars under the General tab are
as I mentioned in my initial posting:
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB
(52,625 bytes) in size.
Compatability shows nothing checked.
Summary no details shown re the author, version number etc.

When this program tries to access the internet ZoneAlarm indicates
that the Destination IP is 206.58.237.248. This IP address appears
to be nothing but a blank page with a grey background.

I have since renamed the file to VSS_PS.XXX and have not run into
any problems with any of the programs I normally use.

A mystery to say the least.

Gerry




The file is in the C:\windows\system32 folder as is vss_ps.dll. I
am thinking that I might rename the file extension to .xxx to see
what if anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or
Home CD, I checked both.

Returns: [[No matches found. Either the database does not contain
this file, or your search term was not appropriately entered. ]] @
DLL Help Database

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In Heeby Jeeby <[email protected]> hunted and pecked:
The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the
folder. I've run Noron AV and it doesn't detect the file as a
virus. Also ran Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a
complete scan.

--
Hope this helps. Let us know.
Wes

In GEB <[email protected]> hunted and pecked:
Recently I've noticed that the file VSS_PS.EXE is starting on
boot up. In addition, my firewall asks whether I want the file
to access the internet (so far I've have not granted it
permission). The file is located in my c:\windows\system
folder. The file was apparently created on Friday, August 17,
2001, 9:02:03 PM and is 51.3 KB (52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the
internet and if so for what purpose?

Thanks

 

[GEB]

Just thought that I'd let everyone know that Norton Anti-virus today
detected the file as a download trojan and deleted it.

Mystery solved at last.

Gerry

Gerry,

Changing the name was a good idea. Does it still try to access the
internet? Does it still try to start at boot? Any error messages?
Are you hungry? Just kidding.

206.58.237.248 has something to do with this site.

http://www.verio.net/

Mean anything to you?

I am very leery when an exe file has no version tab. Reeks of scumware.
Monitor it for a while and then delete VSS_PS.EXE.
If it is legit, which I doubt and you need it, you can always reinstall
whatever it was part of.

C:\windows\prefetch\VSS_PS.EXE-O6AD80C2.PF is just a file to
make VSS_PS.EXE load faster.

I would get some scumware ammo (below) if you don't have any of these
programs.

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp
--
Hope this helps. Let us know.
Wes

In

I'm running XP Home edition. Here's what I've found.

2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and
the other in the C:\windows\system32\dllcache.

I found the VSS_PS.EXE file in the C:\windows\system32 folder. I also
found a file named VSS_PS.EXE-O6AD80C2.PF in the C:\windows\prefetch
folder.

I ran sfc /scannow but didn't receive any messages when the program
finished, so I assume all was OK.

The properties for the VSS_PS.EXE file shows three tabs General,
Compatability and Summary. The particulars under the General tab are
as I mentioned in my initial posting:
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB (52,625
bytes) in size.
Compatability shows nothing checked.
Summary no details shown re the author, version number etc.

When this program tries to access the internet ZoneAlarm indicates
that the Destination IP is 206.58.237.248. This IP address appears to
be nothing but a blank page with a grey background.

I have since renamed the file to VSS_PS.XXX and have not run into any
problems with any of the programs I normally use.

A mystery to say the least.

Gerry

The file is in the C:\windows\system32 folder as is vss_ps.dll. I am
thinking that I might rename the file extension to .xxx to see what
if anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or
Home CD, I checked both.

Returns: [[No matches found. Either the database does not contain
this file, or your search term was not appropriately entered. ]] @
DLL Help Database

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In Heeby Jeeby <[email protected]> hunted and pecked:
The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
I've run Noron AV and it doesn't detect the file as a virus. Also
ran Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a
complete scan.

--
Hope this helps. Let us know.
Wes

In GEB <[email protected]> hunted and pecked:
Recently I've noticed that the file VSS_PS.EXE is starting on
boot up. In addition, my firewall asks whether I want the file
to access the internet (so far I've have not granted it
permission). The file is located in my c:\windows\system folder.
The file was apparently created on Friday, August 17, 2001,
9:02:03 PM and is 51.3 KB (52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the
internet and if so for what purpose?

Thanks

 

[Wesley Vogel]

Glad you got it fixed.

--
Hope this helps. Let us know.
Wes

In

Just thought that I'd let everyone know that Norton Anti-virus today
detected the file as a download trojan and deleted it.

Mystery solved at last.

Gerry

Gerry,

Changing the name was a good idea. Does it still try to access the
internet? Does it still try to start at boot? Any error messages?
Are you hungry? Just kidding.

206.58.237.248 has something to do with this site.

http://www.verio.net/

Mean anything to you?

I am very leery when an exe file has no version tab. Reeks of
scumware. Monitor it for a while and then delete VSS_PS.EXE.
If it is legit, which I doubt and you need it, you can always
reinstall whatever it was part of.

C:\windows\prefetch\VSS_PS.EXE-O6AD80C2.PF is just a file to
make VSS_PS.EXE load faster.

I would get some scumware ammo (below) if you don't have any of these
programs.

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page
properly or perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if
a Web page needs them in order to display the page properly or
perform a particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are
really good. Download, install, run, update and run again; one or
all. They are all good, FREE utilities.

Run CWShredder first!!! <<<<<<<<<<<<

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it
from ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp
--
Hope this helps. Let us know.
Wes

In

I'm running XP Home edition. Here's what I've found.

2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and
the other in the C:\windows\system32\dllcache.

I found the VSS_PS.EXE file in the C:\windows\system32 folder. I
also found a file named VSS_PS.EXE-O6AD80C2.PF in the
C:\windows\prefetch folder.

I ran sfc /scannow but didn't receive any messages when the program
finished, so I assume all was OK.

The properties for the VSS_PS.EXE file shows three tabs General,
Compatability and Summary. The particulars under the General tab are
as I mentioned in my initial posting:
created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB
(52,625 bytes) in size.
Compatability shows nothing checked.
Summary no details shown re the author, version number etc.

When this program tries to access the internet ZoneAlarm indicates
that the Destination IP is 206.58.237.248. This IP address appears
to be nothing but a blank page with a grey background.

I have since renamed the file to VSS_PS.XXX and have not run into
any problems with any of the programs I normally use.

A mystery to say the least.

Gerry




The file is in the C:\windows\system32 folder as is vss_ps.dll. I
am thinking that I might rename the file extension to .xxx to see
what if anything happens to any of the programs.

Gerry

Gerry.

What folder are you referring to?? This might be a clue.
Scratch that. c:\windows\system right??

I am running XP Pro. vss_ps.dll is in these two folders:
C:\WINDOWS\system32
and
C:\WINDOWS\system32\dllcache

vss_ps.dll
Size: 16.5 KB (16,896 bytes)
Size on disk: 20.0 KB (20,480 bytes)
File version: 5.1.2600.0
Description: Microsoft® Volume Shadow Copy Service proxy/stub

How many copies of vss_ps.dll do you have??
In what folders??

Right click VSS_PS.EXE | Properties | Look under all tabs |
Especially the version tab | General tab > Opens with??

VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or
Home CD, I checked both.

Returns: [[No matches found. Either the database does not contain
this file, or your search term was not appropriately entered. ]] @
DLL Help Database

http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp

[[Your search - VSS_PS.EXE - did not match any documents.]] @
www.google.com


Start | Run | Type: sfc /scannow |OK
Have your XP CD ready to stick in your CD drive.

scannow sfc (sfc.exe)
http://www.updatexp.com/scannow-sfc.html

--
Hope this helps. Let us know.
Wes

In Heeby Jeeby <[email protected]> hunted and pecked:
The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the
folder. I've run Noron AV and it doesn't detect the file as a
virus. Also ran Ad-awre and SpyBot. Again nothing.

Any further thoughts?

Gerry

vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
proxy/stub

vss_ps.exe does not appear to be an XP file.

Check your spelling or update you anti virus software and run a
complete scan.

--
Hope this helps. Let us know.
Wes

In GEB <[email protected]> hunted and pecked:
Recently I've noticed that the file VSS_PS.EXE is starting on
boot up. In addition, my firewall asks whether I want the file
to access the internet (so far I've have not granted it
permission). The file is located in my c:\windows\system
folder. The file was apparently created on Friday, August 17,
2001, 9:02:03 PM and is 51.3 KB (52,625 bytes) in size.

If this a legitimate windows file. Does it need to access the
internet and if so for what purpose?

Thanks