What the heck is this???

[Martoch]

Hey guys!

I checked out our laptop this morning to find this little critter loading up multiple times (see pic below). Adaware, Spybot, and Norton find nothing. I uncheck it in msconfig, reboot, it's checked again. I even deleted the registry entries and a few of them keep returning. I'm unable to delete the folder...says it's in use constantly...the folder contains two .exe files (qttuwx [inetsvc] and xwuttq [inetkw],) as well as numerous DAT files named url, exit, dfs, and babe. It's really slowing down the boot time and the comp speed in general. Win XP Home on Gateway laptop. I'm not sure when it started loading because I pretty much never use the laptop.



What do you make of it?

Thanks!
Mike

[GroundZero3]

what is the name of the folder it is in?

[Martoch]

C:\Program Files\wtpprvx

[doddsy]

can we have a shot with the "command" section expanded.

might give us something more to google with

[Martoch]

Sure can...registry entry screenie coming first.

[jkrohn]

First thing I would do is boot into safe mode and toast all files associated with those entries.

If that doesn't work fire up knoppix or any other linux boot cd and toast them there. From there you should be able to remove the registry entries.

Jkrohn

[John Prophet]

might try running cwshredder http://www.majorgeeks.com/download4086.html

it will sometimes get things that adaware/spybot miss

maybe run www.trendmicro.com online scan in case norton has been compromised

[Martoch]

Here's the reg shot:



I'm not familiar with Knoppix or any other linux boot cd.

I've been running trend online scan for a few mins...so far nothing yet.

[clearbluereason]

my vote is with safe mode to kill all associated files, and knoppix is a linux bootable CD that lets you get access to any comp w/ boot from cd checked kinda nice tool to work on stuff. But to use knoppix you need to be somewhat linux savvy.

[EvilRick]

First off, get rid of Norton Internet Security.

Download a REAL firewall like Sygate

Go and download SpySweeper and update it/scan your system.

Get NOD32 and update it/scan your system.

Download Hijack This if you're still having problems after all that.