Forum Home
Press F1
 
Thread ID: 42572 2004-02-15 05:39:00 1111a - b-or c exe? teejay (2526) Press F1
Post ID Timestamp Content User
215697 2004-02-15 05:39:00 I have Windows 98 and IE 5.5. A new programme has appeared on my computer and has placed itself in the startup list. If I delete it from startup using MSCONFIG it simply reinstalls itself there. I suspect that it is either a dialler or spyware as it regularly tries to connect to the internet but ZoneAlarm allows me to prevent that. It is located in C\Windows?system and cant be deleted. So - does anyone know what this programme is ? (it is only 33kb) or,more importantly , how to get rid of it? Any help or suggestions very gratefully received. Thanks. (P.s - Spybot does not show it as spyware) teejay (2526)
215698 2004-02-15 05:51:00 try restarting into msdos mode, then deleting it

is the file in c:\windows\system or c:\windows?system ?

either way, point the command line to it by typing in:

cd c:\windows\system OR cd c:\windows?system

then delete it with

del nameoffile.exe
Growly (6)
215699 2004-02-15 06:02:00 Well you should be on IE6 for a start - security wise etc etc.

So you've got ZoneAlarm, SpyBot won't detect it (is this updated), however have you an AntiVirus program? Is it updated?

A quick Google™ search for 1111a.exe gives me stacks of information about this being as a result of the W32.Dumaru.AH@mm Virus.

Symantec Info (securityresponse.symantec.com)
whiskeytangofoxtrot (438)
215700 2004-02-15 06:06:00 This is kinda new....

Discovered on: February 10, 2004
Last Updated on: February 11, 2004 12:36:00 PM
whiskeytangofoxtrot (438)
215701 2004-02-15 06:22:00 Bother - I overlooked doing a Google search. I updated an ran my AVG anti virus programme AND ran it earlier this evening and it did NOT detect the virus. Now I had better do a search to see how to remove it. Thanks for the information. teejay (2526)
215702 2004-02-15 06:39:00 Look at the Symantec link given above.. it tells you what to do.

Also, try the online virus housecall here (housecall.antivirus.com) first.
Pheonix (280)
1