exe Files

[Dan Sontup]

New laptop, running XP Home.

msconfig>startup

Many programs, all in drive C:, except for three exe Startup Items:

ati2mdxx.exe
carpserv.exe
msblast.exe

All three above have enable box checked. All three are located in
HKLM\Software\Microsoft\Windows\Current ver...

Have never opened an attachment. No anti-virus program installed as yet.
Have checked two display computers in local store. None of these three
programs are listed in msconfig.

Can anyone tell me what these programs are and what they do?

Thanks for any help -- Dan

[Steve C. Ray]

msblast is a worm. You can go to www.symantec.com and download the removal
tool.

--
Steve C. Ray
Replace "mail" with "36db"
"Dan Sontup" > wrote in message
ink.net...
> New laptop, running XP Home.
>
> msconfig>startup
>
> Many programs, all in drive C:, except for three exe Startup Items:
>
> ati2mdxx.exe
> carpserv.exe
> msblast.exe
>
> All three above have enable box checked. All three are located in
> HKLM\Software\Microsoft\Windows\Current ver...
>
> Have never opened an attachment. No anti-virus program installed as yet.
> Have checked two display computers in local store. None of these three
> programs are listed in msconfig.
>
> Can anyone tell me what these programs are and what they do?
>
> Thanks for any help -- Dan
>
>

[Dan Sontup]

Steve C. Ray wrote:" ...

> msblast is a worm. You can go to www.symantec.com and download the removal
> tool.

Many thanks for the quick response to my query. It would be most helpful if
I knew what this worm does and how it may have infected my new
factory-sealed computer.

Any help or insights would be much appreciated.

Dan

[NaresH KumaR]

ati2mdxx.exe ---spyware
Carpserve.exe is related to Zoltrix Modems. So uninstall and reinstall the
modem drivers
msblast.exe -- Removal instructions http://www.updatexp.com/msblast-exe.html

Using Anti-spyware tools:
********************
1. Ad-aware:
Download and install Ad-Aware from any of the URLs given below:
To erase the spyware programs from loading from your system, download and
install a third party utility called Ad-aware from any of the URLs given
below:
http://www.webattack.com/get/adaware.shtml
-or-
http://www.webattack.com/dlnow/dlnow.dll?Inc=No&ID=100156
-or-
www.lavasoftusa.com

Install the downloaded program and update the program and then run it to
erase the spyware programs from your system.

2. Spybot
You can download spybot from the URL given below:
http://download.com.com/3000-2144-10122137.html

--------------------------
pbsnareshkumar

"Dan Sontup" > wrote in message
link.net...
> Steve C. Ray wrote:" ...
>
> > msblast is a worm. You can go to www.symantec.com and download the
removal
> > tool.
>
> Many thanks for the quick response to my query. It would be most helpful
if
> I knew what this worm does and how it may have infected my new
> factory-sealed computer.
>
> Any help or insights would be much appreciated.
>
> Dan
>
>
>

[cimex]

PS: It may seem ridiculous, but Windows XP ships with its firewall
NOT-enabled! So, you may have gotten msblast in the first seconds of your
first online session! See help & support for firewall instructions. Be sure
to get all the MS critical updates; one of them prevents the msblast worm
from getting in. You would hate to get it twice.


"NaresH KumaR" > wrote in message
...
> ati2mdxx.exe ---spyware
> Carpserve.exe is related to Zoltrix Modems. So uninstall and reinstall the
> modem drivers
> msblast.exe -- Removal instructions
http://www.updatexp.com/msblast-exe.html
>
> Using Anti-spyware tools:
> ********************
> 1. Ad-aware:
> Download and install Ad-Aware from any of the URLs given below:
> To erase the spyware programs from loading from your system, download and
> install a third party utility called Ad-aware from any of the URLs given
> below:
> http://www.webattack.com/get/adaware.shtml
> -or-
> http://www.webattack.com/dlnow/dlnow.dll?Inc=No&ID=100156
> -or-
> www.lavasoftusa.com
>
> Install the downloaded program and update the program and then run it to
> erase the spyware programs from your system.
>
> 2. Spybot
> You can download spybot from the URL given below:
> http://download.com.com/3000-2144-10122137.html
>
> --------------------------
> pbsnareshkumar
>
> "Dan Sontup" > wrote in message
> link.net...
> > Steve C. Ray wrote:" ...
> >
> > > msblast is a worm. You can go to www.symantec.com and download the
> removal
> > > tool.
> >
> > Many thanks for the quick response to my query. It would be most helpful
> if
> > I knew what this worm does and how it may have infected my new
> > factory-sealed computer.
> >
> > Any help or insights would be much appreciated.
> >
> > Dan
> >
> >
> >
>
>

[Sharon F]

On Tue, 21 Oct 2003 18:52:10 GMT, Dan Sontup wrote:

> New laptop, running XP Home.
>
> msconfig>startup
>
> Many programs, all in drive C:, except for three exe Startup Items:
>
> ati2mdxx.exe
> carpserv.exe
> msblast.exe
>
> All three above have enable box checked. All three are located in
> HKLM\Software\Microsoft\Windows\Current ver...
>
> Have never opened an attachment. No anti-virus program installed as yet.
> Have checked two display computers in local store. None of these three
> programs are listed in msconfig.
>
> Can anyone tell me what these programs are and what they do?
>
> Thanks for any help -- Dan

The first one is part of your ATI drivers and software.
The second one is related to modems.
The third one is not good. It's the Blaster worm :(

If you are being notified about an impending shutdown, use Start> Run and
type in shutdown -a to abort the shutdown.

Then see the references below for more information about what it is, how to
remove it and how to protect your system against future infection.

What You Should Know About the Blaster Worm
http://www.microsoft.com/security/incident/blast.asp

W32.Blaster.Worm Removal Tool
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.removal.tool.html

MS-MVP Kelly Theriot's Repair Solution:
http://www.kellys-korner-xp.com/xp_qr.htm#rpc

--
Sharon F
MS MVP - Windows Shell/User

[DCC]

Your ati2mdxx.exe is NOT a virus, it is for your ati video card.