I'm a newbie so treat me gently! Hello to everyone here. I am just a basic learner about security at this stage.

I don't know if this is is a common problem. I have searched here and a few other sites and can find no mention of this file. So here goes.

I am running WIN98, a broadband connection, Sygate Personal Firewall, VET Antivirus and IE6. Sygate shows that when I startup, the program PSPS.exe creates a major incoming attack - so I've blocked it. This file is located at c:\windows\all users\start menu\programs\startup. It can't be deleted in Windows. I can no longer access the DOS command line by shutting down windows and restarting in DOS - the machine just locks up. The only way to get there is to use an emergency boot disk. When I do it seems impossible to delete this file - I finally worked out how and found that it reinstalls when you reboot into windows.

I don't know what this file is or actually does, or if it is something bad - but is does seem supicious. But some other things have been happening recently on my machine which may or may not be related. The machine seems to stall regularly and just sit waiting for up to 10 or more seconds before it executes a command. I can't run defragmenter as the disk keeps getting accessed by something every 30 seconds or so - yet I've turned off the obvious things and it used to run without problems.

I've tried tracing the attack via Sygate and get this info from "whois" -

Performance Systems International Inc. (NET-PSINETA)
510 Huntmar Park Drive
Herndon, VA 22070
US

Netname: PSINETA
Netblock: 38.0.0.0 - 38.255.255.255
Maintainer: PSI

Coordinator:
PSINet, Inc. (PSI-NISC-ARIN) hostinfo@psi.com
(518) 283-8860

Domain System inverse mapping provided by:

NS.PSI.NET 38.8.48.2
NS2.PSI.NET 38.8.50.2
NS5.PSI.NET 38.8.5.2

Record last updated on 08-Aug-2002.
Database last updated on 23-Aug-2002 16:56:03 EDT.

but the web addresses seem to be a deadend.

Can anyone help?

Yours in secure anticipation!

powerd