What virus could it be ? ? ?

Hi, a friend brougt me his computer a HP Pavillion 511w running win xp home, the computer is infected with msblaster, but it seams that it has another virus aswell. what makes me think that there is a nother virus is that when i press Alt+CTRL+Del it shows the thask manager screen only for about 3 seconds and i see a file named PUP.exe with a visual basic kind of icon also when im trying to open regedit it closes in afew seconds does anyone knows of a virus that does what i just discribed. I Googled for PUP and Pup.exe and nothing out of the ordinary.

Thanks in advanced.

don't think pup.exe is a virus (not unless you include MS products in that category). To quote from MS

Quote:

---

You can run Commerce Server Site Packager from the command line interface by using the run-time file, Pup.exe. Site Packager includes a set of command line switches that you use to perform tasks on sites and resources, including packaging, unpacking, and deleting a site or resource. In addition, you can establish unique resource references for custom installation requirements by using Microsoft Visual Basic scripts.

---

from here;

http://msdn.microsoft.com/library/de...c_pup_gcss.asp

what does the AV scan say about another virus... and which one are you using?

Z

Hi graphictron,

your friend has problems...............he needs a good AV and a good firewall..........he may have to pay for these?......aaaawwwwwwwwwwwwwww shucks..............?...Zone Alarm, Tiny & others do free ones?

Ok.....try this:

Find the PC-Cillin logsite, and run an online av test called "housecall"

Get AD-Aware 6 from Lavasoft.....update & run it

Get SpyBot Search & Destroy, update and run it

This might help in the short term.

After you have sorted this maybe think about some level 2 & 3 defences?

Please let me know how you are getting on...and I will try to help some more


Cheers & Good Luck!

thanks for the fast reply. i don't think that pup was the virus what i just found is that it has w32.yaha virus i found the winservices in the registry. i couldn't run regedit in the computer so i copied from another machine and renamed it, and i was able to acces the registry.

My friend didn't installed any AV i,m going to tell him to go and buy one.

I refuse to promote any supplier, other than to personal friends, where I can see requirements.

Your friend needs

1. Antivirus

2. Firewall

Please ensure that he gets both :)

Cheers

maybe with this he finally desides to switch to SUSE :D or at least Slackware.
thanks nihil for the comment

There is a virus that is farily recent called WINPUP32.EXE that your friend might have.
It can load a trojan file on the target system. I had a user who had a problem with this.

true omalakai, but if I'm not mistaken the active process for that trojan is winpup32.exe NOT pup.exe

could of course be wrong but I haven't found any AV company that says that the trojan uses any active process other than winpup32.exe

Z

go here:
linuxiso.org, and choose your flavor.
then, from a bootable floppy, in DOS, type "format c:" without the quotes
proceed with your preferred flavor of linux.

if that doesn't seem appetizing, you may want to do a clean install anyways. You can back up all of the data, settings, save game files, etc etc, and start anew. that's the easy way. i would have fun trying what the rest of these guys said, but i guess it depends on how long your friend is willing to go without that PC. i stand by my "format c:"

~AxessTerminated

Quote:

---

go here:
linuxiso.org, and choose your flavor.
then, from a bootable floppy, in DOS, type "format c:" without the quotes
proceed with your preferred flavor of linux.

---

am sick to death of these types of posts - if they guy wanted advice on what operating system he should have installed he would have asked. Big deal he uses windows - so what if you dont like it? come on even your own website says you use ME

Quote:

---

am very familiar with

the Windows scene, and all the crap that comes with it. Ack, I hate

M$, especially since this thing runs ME

---

ok so your showing your dislike for it - but your still running it

anyone can say "format c:" but how about you do something usefull? try and provide some information about the virus or removal tips..........but why o why drag up an old post just to be a dick? am sure your capable of doing that well enough on more recent threads

v_Ln

I have some AO flame retardant suits available at a LOW LOW cost .. Axess..

I have had good luck with
http://www.grisoft.com/us/us_dwnl_free.php

its free and when I have installed it over the top of norton or symantec (on a machine thats acting virusy) 3 out of 5 times, its the installed AV software thats infected, among other things

GrApHiCTrOn,
I'm not sure if you already took care of the Yaha virus completely but just in case, you can go Here for some Yaha removal tools from Symantec.

Also,

Quote:

---

you may want to do a clean install anyways. You can back up all of the data, settings, save game files, etc etc, and start anew. that's the easy way

---

AxessTerminated, I completely agree with you. I'd much rather spend hours upon hours upon hours doing a clean install then to spend 10 minutes using a virus removal tool from Symantec. who wouldn't?

so whats happening?did you get the virus removed?here is the link of the removal tool of W32.Yaha.F in case u didnt download it yet.

IS PUP.EXE A PROCESS?

IF SO it may be a trojan/virus using pup.exe to hide the activitys. Does your CPU often have 90% + of its resources occupied by this process (CTRL + ALT + DEL got to processes to see).

----- IN ORDER------

Firstly go to
-http://grc.com/dcom/intro.htm

download this program an run it (cant be bothered to explain what it is go to URL and u will see)

Now go to this site, download the firewall and install it

-www.agnitum.com/download/outpost1.html

and lastly check for the virus and delete it on this online virus checker

-http://www3.ca.com/securityadvisor/virusinfo/scan.aspx


i would suggest you get some antivirus software Norton is a good choice, im not sure what good free software there is but i would pay the money for the protection

GOOD LUCK