CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

pup.exe, over.exe

 
Post new topic   Reply to topic       All -> FavForums -> Unknown Files [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
bbbrian

Guest
IP: 68.108.*.*






PostPosted: Fri Apr 02, 2004 3:34 am    Post subject: pup.exe, over.exe
Reply with quote

I found these files while browsing through my "Program Files" folder.

I Google searched this and results showed it is a worm/spyware. So I deleted it, but something tells me it isn't that simple.

I have Ad-Aware, SpyBot S&D, SpywareGuard, and SpywareBlaster.

Anybody run into a similar problem and can give advice how to get rid of it?

Back to top
Arturo

Cadet
Cadet


Joined: Mar 31, 2004
Posts: 1
Location: USA

PostPosted: Fri Apr 02, 2004 3:25 pm    Post subject:
Reply with quote

Look for "do.exe" in your system. As long as it is there, it will return you to http://achtungachtung.com and re-install pup.exe and over.exe. Picked up my copy on redirect from http://default-homepage-network.com.

Norton Firewall can stop do.exe from accessing the internet. Probably other firewalls will work, too.

Back to top
View users profile Send private message
Whatever

Guest
IP: 24.137.*.*






PostPosted: Tue Apr 13, 2004 11:30 pm    Post subject:
Reply with quote

wrote:
Look for "do.exe" in your system. As long as it is there, it will return you to http://achtungachtung.com and re-install pup.exe and over.exe. Picked up my copy on redirect from http://default-homepage-network.com.

Norton Firewall can stop do.exe from accessing the internet. Probably other firewalls will work, too.
I searched my sytem for do.exe but it's not there. pup.exe keeps coming back though....

Back to top
Mere_Mortal

1st Responder


Joined: Apr 10, 2004
Posts: 4191
Location: Kidderminster
1st Responders Rootkit Responders

PostPosted: Thu Apr 15, 2004 4:44 am    Post subject:
Reply with quote

Infomation regarding this is available here;
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_REVOP.A

Back to top
View users profile Send private message Visit posters website
kayfelix

Guest
IP: 212.50.*.*






PostPosted: Sun Apr 25, 2004 9:21 pm    Post subject: do.exe, pop.exe, over.exe etc
Reply with quote

Does this have something to do with DDBSE32O.exe in c:\windows\system ?

I found this file starting up every windows session and hiding itself from the task manager. Its only 64kb and was written in VB6.

I havent a clue what this program does / did, but I disabled it starting at boot, rebooted and deleted it.
Couldnt find any info on the net.

Regards,
Kayfelix Very Happy

Back to top
Mere_Mortal

1st Responder


Joined: Apr 10, 2004
Posts: 4191
Location: Kidderminster
1st Responders Rootkit Responders

PostPosted: Mon Apr 26, 2004 9:32 pm    Post subject:
Reply with quote

The only g00gle reference at all is...
http://www.computercops.us/print-1-24622.html

DDBSE32O.exe could be picked randomly from a select list, which may well be dropped into the System folder as a result of the WinPup Trojan...
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?Vname=TROJ_WINPUP.B
(page currently unavailable at this time)

kayfelix...check you Program Files for Pup.exe & Over.exe as well as the instructions given at...
http://www.trendmicro.com/vinfo/virusen...OJ_REVOP.A
...should it match your case.

Regards Smile


_________________
[Malware Removal and Prevention] [Malware Complaints]
Back to top
View users profile Send private message Visit posters website
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Unknown Files All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You cannot download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer