what is fcfB.exe?

  • Thread starter Thread starter bob engler
  • Start date Start date
B

bob engler

A neighbor has WINXP on a compaq that was very infected. Running
Norton Virus 2005 and Spybot I got rid of most problems. I found some
leftover viruses and manually deleted them. There is still a program
named fcfB.exe running when I use taskmanager. I ended it but it came
back in seconds while I watched taskmanager and replicated itself
constantly until I rebooted.
Any ideas what it is and if I need to do something with it.
Also, how do I delete a file with "Share" on doing attrib on it? I tried to
delete 'w?wexec.exe' but couldn't and it showed 'share'.

Thanks.......
 
Hi Bob,

In most cases without using third party, this takes three steps.

1. Start/Run/Regedit

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Gain the exact path.
Note: Save these two to regedit favorites.

2. Start/Run/Msconfig/Startup

Gain the exact path.

3. Follow the path via Windows Explorer.

Leave/have all three windows opened, now open the Task Manager.

Once knowing the exact path, end the process via the Task Manager, then
delete the entry via Windows Explorer. From there, delete the run command
from both regedit and msconfig. With regedit still open, hit F5. If it
replaces itself, you didn't do it in a timely manner or you didn't follow
the exact placement path.

Note: In some cases, depending, you will be allowed to rename the .exe via
safe mode and then delete.

Note2: Never depend on Norton alone.

Will include Spybot within my next suggestion, if the above hasn't helped:

Run Ad-Aware SE, Spybot and HijackThis:
http://www.majorgeeks.com/downloads31.html

Note: Update the first two programs, once installed, before running.

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Good luck and keep us posted!

--
All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com
 
An alternmate, but similar, set of instructions to that of Kelly's.

Dump the contents of the IE Temporary Internet Folder cache (TIF)

start --> settings --> control panel --> internet options --> delete files


1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt442.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.htm
4) Reboot your PC into Safe Mode and shutdown as many applications as possible
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point


* * * Please report your results ! * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html





| A neighbor has WINXP on a compaq that was very infected. Running
| Norton Virus 2005 and Spybot I got rid of most problems. I found some
| leftover viruses and manually deleted them. There is still a program
| named fcfB.exe running when I use taskmanager. I ended it but it came
| back in seconds while I watched taskmanager and replicated itself
| constantly until I rebooted.
| Any ideas what it is and if I need to do something with it.
| Also, how do I delete a file with "Share" on doing attrib on it? I tried to
| delete 'w?wexec.exe' but couldn't and it showed 'share'.
|
| Thanks.......
|
|
|
 
Ouch, you may want to consider dumping Norton (Symantec) product(s) in the
future and going with Gary S. Terhune's suggestion of E-Trust CA corporate
edition that has an awesome software firewall as well as an antivirus
package. Computer Associates extended their special deal again and I highly
suggest buying EZARMOR because it is working great for me. Good Luck with
fixing your computer. Have a nice day.

: A neighbor has WINXP on a compaq that was very infected. Running
: Norton Virus 2005 and Spybot I got rid of most problems. I found some
: leftover viruses and manually deleted them. There is still a program
: named fcfB.exe running when I use taskmanager. I ended it but it came
: back in seconds while I watched taskmanager and replicated itself
: constantly until I rebooted.
: Any ideas what it is and if I need to do something with it.
: Also, how do I delete a file with "Share" on doing attrib on it? I tried to
: delete 'w?wexec.exe' but couldn't and it showed 'share'.
:
: Thanks.......
:
:
:
 
Back
Top