refbeepbolt.exe and mps.exe

[MSGJack]

Ran Hijackthis, adware, spybot on my win 98 computer and it still takes an hour to load IE. Been going through every message looking for things to delete other than those i.d.'d by the above mentioned tools. I've got two that I can't find anywhere.

c:\windows\system\mps.exe
C:\program files\proxy axis\refbeepbolt.exe

04 - HKLM\..\run: [file bin] C:\program files\proxy axis\refbeepbolt.exe

I've also got 28 - 016 - DPF: {...} ....cab's

I saw where I can delete any 016's is that correct?

 

[carrr]

c:\windows\system\mps.exe is part of the PWSTEAL.TROJAN - not something you want around:

http://www.convina.com/go/knowledgebase/100354095/

C:\program files\proxy axis\refbeepbolt.exe

04 - HKLM\..\run: [file bin] C:\program files\proxy axis\refbeepbolt.exe
...you got me. If in doubt, kick it out of its RUN designation and see what happens. Or, check in the folder where it lives in program files for more clues.

RE: 016's...yes, you can kill them without fear. If needed, you'll be prompted to download them sooner or later.







"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[MSGJack]

Just tried to delete these two files and the system want let me delete them. I'm going to try and open up in DOS and see if I can do it there. I got the winactive parasite two days ago and I think based on what messages I've read this is a new variation with new files. It's really ugly.

 

[diogenes10]

Think you ought to follow carrr's suggestion and check proxy axis folder, there may be other stuff in there you should delete too.

 

[carrr]

You can likely knock them out in safe mode, as well. Something likeley "using" them once your processes are running (as refbeepbolt is clearly in your startups).

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[CableInstaller]

winactive is targeted by Ad-aware, if it was not detected then you most likely are scanning with an outdated reference file, the current is 01R270 18.03.2004. on Ad-aware(build 181)
A tool what I have been working on is KillBox available at

http://download.broadbandmedic.com/

which is a process killer/deletion utility, and may have some success in removing files, running or not, without the need for Safemode or Dos.

 

[MSGJack]

Killed it in Safe Mode. I still got problems though. IE is not wanting to load. I'll let you'all know. Thanx people you are the greatest!