DelphiFAQ Home Search:
Windows
    Apache (10)
    File Types (33)
    Internet Explorer (6)
    Network (11)
    Passwords (6)
    Printing
    Processes (13)
    Programming (243)

 
Exchange Links
 
About this site

Links to us

 

 

 General :: Windows :: Processes
Do you wonder what that long list of processes in your task manager comes from? Are all those programs running there really needed or are they a virus, adware, spyware.. recording all your keystrokes and then sending your passwords to a remote server? Read the articles below and learn about some of those processes.

Articles:

This list is sorted by recent document popularity (not total page views).
New documents will first appear at the bottom.
Featured Article

bla.exe / Scvhost.exe trojan horse keeps coming back!

Question:

I cannot get rid of this trojan horse bla.exe. I first found it after I kept getting error messages from WinAmp ('Illegal Operation' on drive C:) even though I was not running WinAmp and I have WinAmp installed on drive E:.

I started the computer in safe mode, twice, and removed both of them and they just keep coming back.

Answer:

bla.exe belongs to the W32.HLLW.Gaobot worm. This worm attempts to spread to network shares with weak passwords. W32.HLLW.Gaobot also provides a hacker access to the infected computer through IRC. It uses the DCOM RPC vulnerability (tcp port 135, Windows XP) and the RPC locator vulnerability (tcp port 445).

There is a upx compressed version of this worm, the compressed version is classified as W32.HLLW.Gaobot.AE
It affects computers with Windows NT, Windows 2000 and Windows XP.

Besides running as bla.exe, it may also arrive on your computer as Scvhost.exe, WincfgM32.exe or Winhlpp32.exe.

To remove this trojan horse, you need to follow these steps:
  1. Disable System Restore (Windows XP only)
  2. Restart the computer in Safe mode or VGA mode.
  3. Run an updated virus scanner and run a full system scan and delete all the files detected as W32.HLLW.Gaobot.
  4. Delete the value that was added to the registry under
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    There delete "Config Loader"="scvhost.exe"
    and in
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
    delete "Config Loader"="scvhost.exe"
  5. Now boot again in normal mode


Most recent comments
2008-05-14 19:18:40:
by anonymous
in Dating Scams
on Scammer Jane Mabou from Ivory Coast, Africa:
Puras pinches mentiras, n pasen ni su cuenta ni sus datos personales es puro pinche fraude.
2008-05-14 19:05:47:
by anonymous
in Dating Scams
on Dating scammer Goodwill Ajaratu:
Hello dear,
How are you today?.
Thanks hugely for your very nice mail. I hope you are in perfect health and i pray that this mail should find you in peace. It is a pleasure to read from you as ... read more
2008-05-14 18:51:12:
by [hidden]
in Dating Scams
on Dating scammer Harry McDaniel Ashwood, in Nigeria:
Getting email from someone who lives in memphis ...Robin James but is now in Nigeria as an architect....says he's 56...real smoothie
2008-05-14 18:29:12:
by Dirk
in Dating Scams
on Dating scammer Ekaterina Rozhentsova:
Klaus,

Ekaterina is back!

... Und das Gebaude in Minsk (Belarus) auch!!


2008-05-14 18:13:31:
by anonymous
in Dating Scams
on Dating scammer Tessy Koya from Ikeja, Nigeria:
Not sure who can check this one out, but I keep getting emails from a Precious Andrea Love from Ikeja Lagos Nigeria, there is no doubt in my mind that this is a guy that is setting me up for a scam, s ... read more
2008-05-14 17:56:13:
by [hidden]
in Dating Scams
on Dating scammer Olya:
Just checking out this site. . . WOW. . . I am glad I did and have as suggested by a friend. Anyone out there heard of OLYA from the Ukraine?
2008-05-14 17:21:28:
by anonymous
in Dating Scams
on Dating scammer mary horku:
Mary just contacted me off of lavalife, she posted the picture of her washing her clothes. I did a search right away after getting her full name and got this site. Shes now using lovingyoulive@yahoo.c ... read more
2008-05-14 17:20:50:
by [hidden]
in Dating Scams
on Dating scammer Flower sage:
graicas por la informacion de stos estafadores de personas por internet ojala sirva para todos aquellos que creemos que todos son iguales cuidense de estafadores como estos...
2008-05-14 17:16:28:
by anonymous
in Dating Scams
on Dating scammer Ksenia Lihacheva from Diwnogorsk, Russia:
alguien recibe correos de alena??
solo recibi el primero con esta foto,
sera que los estafadores cambiaron de alena a darya???
2008-05-14 16:07:43:
by OJAS
in about DelphiFAQ
on Recognizing similar images:
More on photo recognition ...

Look for unique features. The girl in the above post has a particular middle and last line pattern in her hand. This helps recognize her by right hand.
read more