DelphiFAQ Home Search:
General :: Windows
General Windows topics. User shortcuts, installation/ destallation, compatibility, registry entries, power user and undocumented features.

Articles:

This list is sorted by recent document popularity (not total page views).
New documents will first appear at the bottom.

Featured Article

Red circle with white cross in taskbar tray - saying 'Your computer is infected'

Question:

My computer was infected a while ago with Spysheriff and I got rid of it. But I discovered a red circle with a white cross in my taskbar. When I move my mouse over it, it says 'Your computer is infected':


Answer:

This one is easy to get rid off.
  1. Open the task manager (press Control+Alt+Del)
  2. Select Processes and look for a process named 13242.exe or similar (a pattern of numbers) and kill this process.
    Look for a process named Archive.exe and kill it as well.
    Note that the name of this other program may be different in your case - a known other name is tool2.exe .

  3. Search your hard disk for the file name 13242.exe (or whatever number it may have been in your case). In my case this was in:
    \Documents and Settings\user1\Lokale Einstellungen\Temp
    Other users reported to have found these files in c:\Windows.

    As you can see in the screenshot, I found a LOT of executable files there, most of them the length 0. I could not delete those files until I had killed process 'Archive.exe'.

    The file archive.exe was entered as an auto-start in the registry here:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    I deleted the file Archive.exe from C:\Program Files\Archive:

      Directory of C:\Program Files\Archive
     
     11/24/2004  04:21p      <DIR>          .
     11/24/2004  04:21p      <DIR>          ..
     11/24/2004  04:21p             106,496 archive.exe
                    1 File(s)        106,496 bytes
                    2 Dir(s)   3,235,689,984 bytes free
     


Belorussian Translation
Generated 0:02:39 on May 23, 2017