crash.exe, crash.bat, crash.REG, crash.html

Discussion in 'Internet, Connectivity and Communications' started by noelg24, Dec 14, 2004.

  1. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    Ok here's the scope...I am keeping this one simple...

    4 files: Crash.exe, crash.bat, crash.REG and crash.html. my friend had this on their PC, but not sure how long for, but no matter how many times you delete it, it comes back. this only happens when connecting to the internet. their broadband is with AOL. I have installed Zone Alarm, A2, AVG, Ad-Aware but these cant remove it at all. I went into the registry and located the keys but even deleting them didnt work cos after rebooting and going back online it still came back. the files are all located in C:\ so you cant miss them. any help as to how to get rid of these buggers? thanks.
     
    Certifications: A+
    WIP: my life
  2. Luton Bee

    Luton Bee Kilobyte Poster

    365
    0
    36
    So just to confirm, these files only reappear after the user has connected to the internet (i.e. opened Internet Explorer)? Does the users hopepage get redirected at all?
     
    Certifications: MCSE, MCSA, MCP, A+, Network+ C&G ICT
    WIP: CCNA
  3. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    it dont matter what web page you go to, it just pops up and suddenly a lot of pop ups appear asking it to download something...and it happens about 1 minute after connecting to the Internet without opening a browser.
     
    Certifications: A+
    WIP: my life
  4. Luton Bee

    Luton Bee Kilobyte Poster

    365
    0
    36
    My first thought was some sort of browser hijack using a BHO (browser help object), hence the question about Internet Explorer. It's certainly malware of some sort, have you tried installing both Adaware and Spybot Seach and Destroy (including updated signatuire files), disconnecting the internet router, rebooting in safe mode and scanning using both Adaware and S&D? The files are being created by a program somewhere. You may find further help at www.spywareinfo.com

    Hope this helps.
     
    Certifications: MCSE, MCSA, MCP, A+, Network+ C&G ICT
    WIP: CCNA
  5. noelg24

    noelg24 Terabyte Poster

    3,334
    26
    139
    I installed Ad-aware, and A² and scanned the PC, but nothing. I didnt install Spybot...but i have found a program that seems to do the trick so I will try this and get back to you...thanks...
     
    Certifications: A+
    WIP: my life
  6. nugget
    Honorary Member

    nugget Junior toady

    7,796
    71
    224
    I had the same problem a couple of months ago. Ask if they have installed anything recently, like some sort of toolbar, toolbar helpers etc. They usually come with spyware programs that install silently and put themselves in the startup keys in the registry.:x

    I only discovered this one as an MS patch was installed and it seems it blocked access to the internet for this program, which kept popping up error messages and slowed the machine right down. I don't know how long it was there (>2yrs maybe) but thatsa what happens when you give admin rights to supposedly trustworthy users.:x
     
    Certifications: A+ | Network+ | Security+ | MCP (270,271,272,290,620) | MCDST | MCTS:Vista
    WIP: MCSA, 70-622,680,685
  7. bobjoe

    bobjoe New Member

    1
    0
    1
    hello

    i was browsing along trying to find a solution to my problem which happens to be teh same one as yours. you did say that you found a program which rids of this annoying spyware or virus or whatever it is.

    what program did you find that works, thanks alot for your help and time

    bobjoe.
     
  8. macken

    macken New Member

    1
    0
    1
    I too have this problem - and whatever I have tried so far has not worked. I have Avast antivirus - XSoftSpy ad ware remover - and still Crash.exe restarts after connecting to the internet. When I have connected my anti-virus detects win32:regzonTr virus - I have searched the internet for info on this and not yet found any help on its removal.
    If anyone has successfully removed any of this I would be pleased to hear
    Ian
     
  9. Jakamoko
    Honorary Member

    Jakamoko On the move again ...

    9,924
    74
    229
    Backup. Format. Re-install.
     
    Certifications: MCP, A+, Network+
    WIP: Clarity
  10. OffSide

    OffSide Nibble Poster

    73
    0
    19
    @Jakamoko
    like your style (:
     
    Certifications: N+ MCP 210
    WIP: MCSE

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.