[toy4matt]

Hi,

A week ago, a co-worker accessed his free email account (yah@@) from my PC. Within minutes, my PC was being bombarded with spam, pop-ups, etc.. which before, had never been a problem.

Since then I've cleaned, scanned, quarantined, deleted, removed, etc.. my PC with just about every (legitimate) malware removal software I could find listed at this website.

Everything is now almost back to normal... except for a couple things..

1) When I'm in IE, every webpage I access is followed by a least three pop-ups, which I manually have to close (the Google toolbar USED to stop this before my co-worker used my PC).

2) I now have an un-named, mystery icon in my Control Panel that I cannot remove (doesn't show up as a .CPL file). Even our IT folks couldn't remove it with their tools. Here's a screen shot of the icon (circle w/ two red "swooshes"):



Any ideas of what this thing is, and how to get rid of it? I have a feeling it's what is causing the pop-ups in IE.

Thx,
Matt

Edited by toy4matt, 02 June 2005 - 12:46 PM.

[Advertisements]

Hold the cursor over it to see if it confesses to its origins then click start then run then type msconfig, press enter then start up to look for it there, remove tick if you see it, or anything new, press apply and reboot

[Retired Tech]

Hold the cursor over it to see if it confesses to its origins then click start then run then type msconfig, press enter then start up to look for it there, remove tick if you see it, or anything new, press apply and reboot

[toy4matt]

Keith,

Held the cursor over the icon, but it didn't show "itself" (no pop-up bubble appeared).

Under msconfig/startup, I found and unchecked "ps1.exe", applied, rebooted. It didn't help... pop-up's still popping-up, and the icon is still there in Control Panel.

Everything else in msconfig/startup looked normal. If I didn't know what a file did, I Googled it to see what it was. That's how I found "ps1.exe" was bad.

I just updated ad aware se to the new 1.06 (from 1.05) too. It found and removed "bookedspace". IE Pop-up's and C.P. Icon still there.

I'm all ears Keith

Matt

[toy4matt]

Some good news!

By using a program recommended here called winpatrol, all the Pop-ups I was getting have been eliminated!!

It provides additional information about each program in your Startup, plus info on Active/Scheduled Tasks, IE Helpers, etc.. I found two programs in IE Helpers that were causing the bad adware and removed them. No more Pop-ups!!

I'm still at a loss as to what the mystery icon is my Control Panel. I don't dare double-click on it, unless someone can tell me what'll happen.

Matt

[StarHawk]

Hi toy4matt.

My roommate had the same problem a year or so ago. I showed him your post because I'll never forget that icon. It took me a while to remove it and alas I'm not sure now how I did it. my roommate keeps malware infections, no matter what I do. It's up to me to keep his computer clean. I'm a programmer so friends think I can deal with anything. So I joined Geeks to Go to learn better techniques.

I think I removed it using Hijack This. but I might have found it in the registry. Anyway You clearly have a malware infection and I recommend you follow the advice Here.
You will be ask to download install and use several software tools, as well as Post a Hijack This Log in the Malware section of this forum. Also post a link to this thread so they can see the problem. Do that and Malware experts there will help you clear that up. Don't click the mystery icon, i was scared of that myself and never did it. Who knows what it does? I'd like to know but not enough to try clicking it.

Also by the way have you right clicked it? That should be harmless enough. Try that and let me know what options you have in the right click menu.

Hope this helps.

[toy4matt]

Hi Starhawk,

Thanks for your response. In a day or two, I'll go through the Hijackthis process you provided in your link (my boss just told me he wants me to get busy on my real projects, imagine that).

When I right-click on the icon, I get the standard <Open> and <Create Shortcut> choices (like all the other Control Panel icons).

I have 36 control panel icons, but only 33 ".cpl" items. hmm. I read another website that says all control panel items are really ".dll"(s). I came to the same conclusion that this icon/dll would have to found in registry.

Like I said, I'll post my hijackthis log in a few days (along with a reference to this thread).

Thx again,
Matt

[toy4matt]

Mystery Icon Resolved ( & more importantly REMOVED TOO)!!

As I said before, when I right-clicked on the icon, I was given the choice of <Open> and <Create Shortcut>. So I decided to create a shortcut on my Desktop.

After doing that, I was able to right-click on the new *mystery* Desktop icon, which now gave me a Properties option.

In Properties, I didn't see any new information about the icon until I clicked on Change Icon, which finally revealed it's identity: C:\WINDOWS\SYSTEM\ADPanel.cpl. I was then able to delete it from Explorer. It had an August 14, 2002 1:36:26 PM creation timestamp.

I'm pretty darn sure I didn't see that one earlier, but anyhow now it's GONE now!! Yeaaah baby!!

Thanks Keith and Starhawk for your ideas, it made me investigate more thoroughly!

Matt

Edited by toy4matt, 02 June 2005 - 01:10 PM.

[Retired Tech]

Thank you for posting the solution

[StarHawk]

That's great toy4matt and really quite clever.

I'm pretty sure that's not how I dealt with it, but I'll remember it. Find *.cpl should've found it. I still recommend posting a Hijack This log just to see if there is any other infections left. But I'm glad ya got it straightened out. Now I wonder what installed it and where it comes from.