Index
 |
Webhost - Very Annoying Process - Where is it coming from? | ||
Discussion by twitch with 6 Replies.
Last Update: November 7, 2005, 5:42 am | |||
 |
|||
I'll start from the beginning.
Recently, I formatted my HD, because of all the accumulated rubbish and errors. I re-installed XP SP1 (I can't stand MS Updates, they mess up the system). And installed all my safe programs. I checked my system thoroughly for spyware/viruses/adware/etc and nothing was found. I installed ZoneAlarm and set it up. Then applied my Internet connection.
Everything was fine until the other day when some file downloaded itself onto the computer. WebHost. It contained 3 files. Two with no extensions called Ad (somehow it manages to allow two with the same name) and the third is an .exe called Ad.
It bugged me that ZA allowed such a program to download itself and install. Especially when I made ZA to be on highest security.
I deleted the folder and removed all trace of it (from registry and such). The problem now, is that it is consistantly appearing again. I have deleted it now (completely) four times. And everytime it appears, it loads two Pop-ups with "page cannot be displayed".
So, I would like to know, how the hell can I get rid of it, without excorising the machine.
Recently, I formatted my HD, because of all the accumulated rubbish and errors. I re-installed XP SP1 (I can't stand MS Updates, they mess up the system). And installed all my safe programs. I checked my system thoroughly for spyware/viruses/adware/etc and nothing was found. I installed ZoneAlarm and set it up. Then applied my Internet connection.
Everything was fine until the other day when some file downloaded itself onto the computer. WebHost. It contained 3 files. Two with no extensions called Ad (somehow it manages to allow two with the same name) and the third is an .exe called Ad.
It bugged me that ZA allowed such a program to download itself and install. Especially when I made ZA to be on highest security.
I deleted the folder and removed all trace of it (from registry and such). The problem now, is that it is consistantly appearing again. I have deleted it now (completely) four times. And everytime it appears, it loads two Pop-ups with "page cannot be displayed".
So, I would like to know, how the hell can I get rid of it, without excorising the machine.
Thu Oct 27, 2005 Reply New Discussion
1. search google for a fix.
2. If google doesn't give back anything usefull check the following things:
Kill all the exes in the taskmanager.
goto START -> run -> msconfig , and click check the services and startup tabs for an entry which calls the webhost.
restart your machine, it this works you're done
, if not do this:
check the registry for anything that links to thoses exes and delete them
do a windows search for the exact filesizes of the exes, they could be hiding under a different name.
check the msconfig again and reboot.
If this doesn't work, I wouldn't know either.
2. If google doesn't give back anything usefull check the following things:
Kill all the exes in the taskmanager.
goto START -> run -> msconfig , and click check the services and startup tabs for an entry which calls the webhost.
restart your machine, it this works you're done
, if not do this:check the registry for anything that links to thoses exes and delete them
do a windows search for the exact filesizes of the exes, they could be hiding under a different name.
check the msconfig again and reboot.
If this doesn't work, I wouldn't know either.
Thu Oct 27, 2005 Reply New Discussion
Hehe, get Killbox.. your problem is, as soon as you kill the process, another one spawns itself and when you delete the .exe the process rewrites itself on the disk. Use Killbox to kill it from memory and disk simultaneously - it really helped me on several such occasions. Just google for it - can be downloaded from many sites.
A search for "ad.exe" yielded mostly garbage results - but this one might give you partially related info: http://securityresponse.symantec.com/avcen...itexplorer.html
A search for "ad.exe" yielded mostly garbage results - but this one might give you partially related info: http://securityresponse.symantec.com/avcen...itexplorer.html
Thu Oct 27, 2005 Reply New Discussion
Talk about fast response. Thanks a lot. I'll do it later when I have less to do.
Thu Oct 27, 2005 Reply New Discussion
Right, I have tried the whole memory wipe and such and still, it re-writes itself. But this time it is slightly different. The files are now
Ad (FILE)
Ads (FILE)
WebHost-2 (EXE)
brackets equals file extension, FILE is a generic, no file type
So, what should I do, except smash my computer to pieces with a mallet?
Ad (FILE)
Ads (FILE)
WebHost-2 (EXE)
brackets equals file extension, FILE is a generic, no file type
So, what should I do, except smash my computer to pieces with a mallet?
Sat Nov 5, 2005 Reply New Discussion
QUOTE
So, what should I do, except smash my computer to pieces with a mallet?Not a bad idea... but you could try linux
.But, have you tried an anti-spyware? Try one of these:
1. Ad-aware
2. Spybot S&D
if you have a legal version of Windows, you can also try microsoft anti-spyware from microsoft
It might even be a virus. Reboot your system in safe mode and see if it's still showing up. If it isn't, try scanning your entire system with your antivirus (assuming you have one) and the anti-spyware software.
Try this out and let us know what happens
.
Sat Nov 5, 2005 Reply New Discussion
I've tried:
Anti-spyware (every single piece that is worth downloading)
Anti-virus (again, every single piece that is worth getting)
Killbox (it simply copied the files into its folder and left them there, didn't delete squat)
Regedit (I couldn't find the reg key for it anywhere)
CCleaner (crap cleaner, it took rubbish out, but didn't find anything to do with WebHost)
Kicking my computer when it appears.
There is something new that is happening now, it comes up with a runtime error, when I debug, it is plain HTML, in a exe file, whoever made this needs their heads checking.
Anti-spyware (every single piece that is worth downloading)
Anti-virus (again, every single piece that is worth getting)
Killbox (it simply copied the files into its folder and left them there, didn't delete squat)
Regedit (I couldn't find the reg key for it anywhere)
CCleaner (crap cleaner, it took rubbish out, but didn't find anything to do with WebHost)
Kicking my computer when it appears.
There is something new that is happening now, it comes up with a runtime error, when I debug, it is plain HTML, in a exe file, whoever made this needs their heads checking.
Mon Nov 7, 2005 Reply New Discussion
 |
 |
|
 |
 |
| Reply / Comment | Ask a Question? | Share / Bookmark | E-Mail a Friend |
 Free Security Software Links... No reason to be vulnerable.... (5)
|
(6) Rootkits Installed By Sonybmg's Drm 
|