Tech Support Forums - TechIMO.com - View Single Post

dragonb · February 14th, 2002, 07:37 PM

Hmm, weird one here.
My brother in laws work computer. He picked up something, that every once in a while pops up an internet explorer porn ad, that then prompts to download an activex type dialer program(I think they want you to run it, dial them, and pay a huge phone bill)
Anyway, Norton(fully updated) found nothing.

Also, this happens periodically, even when no browser is open, or when nothing is open actually. Windows XP, fully updated.

The only process running that didn't look familiar was one called openme.exe. Sounds fishy. located in the windows directory.
The only reference to it in the registry was under a key called shell with the value "explorer.exe openme.exe" not referenced in a startup key or anywhere else.
I'm guessing it just starts it up along with explorer upon boot?

I took it out, and deleted the actual file, and going to reboot now.
Just wanted to see if any of you have seen anything like this before?

p.s. downloading some trojan detection progs right now, and mcafee.

dragonb

Also, as per a thread talked about before, this definitely qualifies as "Scumware"!!!

February 14th, 2002, 07:37 PM	#1 (permalink)
dragonb Senior Member Join Date: Oct 2001 Location: Utah Posts: 551	virus, trojan or what? Hmm, weird one here. My brother in laws work computer. He picked up something, that every once in a while pops up an internet explorer porn ad, that then prompts to download an activex type dialer program(I think they want you to run it, dial them, and pay a huge phone bill) Anyway, Norton(fully updated) found nothing. Also, this happens periodically, even when no browser is open, or when nothing is open actually. Windows XP, fully updated. The only process running that didn't look familiar was one called openme.exe. Sounds fishy. located in the windows directory. The only reference to it in the registry was under a key called shell with the value "explorer.exe openme.exe" not referenced in a startup key or anywhere else. I'm guessing it just starts it up along with explorer upon boot? I took it out, and deleted the actual file, and going to reboot now. Just wanted to see if any of you have seen anything like this before? p.s. downloading some trojan detection progs right now, and mcafee. dragonb Also, as per a thread talked about before, this definitely qualifies as "Scumware"!!!