Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

i need help "sxpdr32" =(


  • Please log in to reply
11 replies to this topic

#1 QueenieUAE

QueenieUAE

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 12 August 2005 - 08:53 AM

hi there

it's my first post in here
i have a problem in my pc, and i cannot figure out what it is!

whenever i type any URL in the address textfield, the page keeps refreshing itself, and when i enter any chat-room or any site that needs reloading, it returns me back to the first page!

when the page refreshes itself, in the adress textfield the URL changes to >> C:\WINDOWS\system32

i checked system32 folder in C drive and i found out that there is a file called "sxpdr32" of type Application version 1.0..this file is modified today..whenever i delete it, the pc creates it again!

is it a spyware or what?!

can anybody help me please in solving this problem?!

thanks in advance =)

BC AdBot (Login to Remove)

 


#2 River_Rat

River_Rat

  • Members
  • 773 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Oklahoma - USA
  • Local time:04:28 PM

Posted 12 August 2005 - 09:40 AM

That appears to be an odd looking file.
Lets do a little cleaning and see what happens.

See this article:
Taking out the Trash

See this article:
Deleting Stubborn Files

Have you tried a complete cleaning to see if that helps?
Show all Files & Folders
http://www.bleepingcomputer.com/forums/ind...showtutorial=62
Try these free tools.
Trendmicro (free virus scan only)
http://housecall.trendmicro.com/
Adware SE (update after installing)
http://www.lavasoftusa.com/software/adaware/
Spybot S&D (update after installing)
http://www.download.com/Spybot-Search-Dest...4-10122137.html

After doing this and the problems are not better feel free to post a HJT log.
Be sure to read the How to submit a HJT Log and submit it to the appropriate forum. HJT Forum links provided below.

How to submit a Hijackthis Log
http://www.bleepingcomputer.com/forums/How...s_Log-t956.html
HJT Forum
http://www.bleepingcomputer.com/forums/Hij...alysis-f22.html

#3 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:04:28 PM

Posted 12 August 2005 - 01:51 PM

I believe C:\WINDOWS\system32 are system files and I wouldn't delete or modify anything in there unless you know exactly what you were doing.

#4 alanmadden

alanmadden

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 16 August 2005 - 04:47 PM

I also have the same problem with this file.

Its caused by a website called cash deluxe or something like that that tried to get you to keep visiting their site.

its also installs an 'uninstall helper ' option in your add/remove programs.when you try to uninstall it take you to the website.

I have tried every tool i know,its deletable but always comes back. nothing i know detects this.

im still in the same boat as you - let me know if you have any joy!

//Mod edit: E-mail addy removed to protect from spamming.

Edited by KoanYorel, 24 August 2005 - 01:35 PM.


#5 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:04:28 PM

Posted 16 August 2005 - 09:50 PM

I also have the same problem with this file.

Its caused by a website called cash deluxe or something like that that tried to get you to keep visiting their site.

its also installs an 'uninstall helper ' option in your add/remove programs.when you try to uninstall it take you to the website.

I have tried every tool i know,its deletable but always comes back. nothing i know detects this.

im still in the same boat as you - let me know if you have any joy!

alanmadden@bulldoghome.com

Look at the website carefully and see if there is an uninstall tool on it. There might be.

#6 alanmadden

alanmadden

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 24 August 2005 - 01:12 PM

no install option on the webstie- its a trick they try to get your email address for spaming , however I have managed a workaround.

1. shut the file down using the windows task manager.

2. open notepad and go look for the file in the system32 directory.

3.open the application one - not the speed dial one.

4. select and delete all the nasty code.save the file - no not delete the file.


this allows the file to remane of your system - but its blank so it wont execute its code.- but if you delete it - it will come back in its original form, there must be startup reg entires that reinstall this bastard on startup?


not a solution - but the only option just now,since none of the spyware tools can deltect it/

#7 tg1911

tg1911

    Lord Spam Magnet


  • Members
  • 19,274 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:SW Louisiana
  • Local time:03:28 PM

Posted 24 August 2005 - 03:17 PM

alanmadden,
I've just read about your lengthy fight with, sxpdr32, over at experts-exchange.
Looks like this one, is a real nasty.
You and QueenieUAE should post a HijackThis log, to be examined by our Team.
just follow River_Rat's link, on how to submit a HJT log.
See if they can turn up anything that might have been missed.

I wish you, and QueenieUAE, the best of luck.
MOBO: GIGABYTE GA-MA790X-UD4P, CPU: Phenom II X4 955 Deneb BE, HS/F: CoolerMaster V8, RAM: 2 x 1G Kingston HyperX DDR2 800, VGA: ECS GeForce Black GTX 560, PSU: Antec TruePower Modular 750W, Soundcard: Asus Xonar D1, Case: CoolerMaster COSMOS 1000, Storage: Internal - 2 x Seagate 250GB SATA, 2 x WD 1TB SATA; External - Seagate 500GB USB, WD 640GB eSATA, 3 x WD 1TB eSATA

Become a BleepingComputer fan: Facebook

#8 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 35,758 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:02:28 PM

Posted 24 August 2005 - 03:37 PM

All,

I have been reading up on this lil nasty's habits and one thing I might add. That this specific .exe must be closed in the task manager prior to removal. If it's still running in task manager while doing any removal efforts they will be for naught. It will reappear. I wish I could reference which sites I read that on. But I have forgotten which they were. And as tq1911 has said. GOOD LUCK!

Be (malware) Safe

Da Animal

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+

#9 G-STYLE

G-STYLE

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 24 August 2005 - 08:16 PM

have you tired killbox to getrid of the file?

#10 Mr Alpha

Mr Alpha

  • Members
  • 1,875 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Finland
  • Local time:12:28 AM

Posted 25 August 2005 - 04:10 AM

Have you searched your hard drives checking if there are more than one sxpdr32?
"Anyone who cannot form a community with others, or who does not need to because he is self-sufficient [...] is either a beast or a god." Aristotle
Intel Core 2 Quad | XFX 780i SLI | 8GB Corsair | Gigabyte GeForce 8800GTX | Auzentech X-Fi Prelude| Logitech G15 | Logitech MX Revolution | LG Flatron L2000C | Logitech Z-5500 Digital

#11 Enthusiast

Enthusiast

  • Members
  • 5,898 posts
  • OFFLINE
  •  
  • Location:Florida, USA
  • Local time:04:28 PM

Posted 25 August 2005 - 10:29 AM

If sxpdr32 comes back after you delete it it means there's other malevolent code in your computer making it come back, so that sxpdr32 is not your only problem.

After you run AdAware SE and Spybot Search and Destroy you need to post a Hijack This log in the proper thread of our forum.

Read the pinned post in the HijackThis forum, here
Carefully read and follow all directions exactly.

Run a log, and post it in the HJT forum, at this link.

Do not attempt to fix anything, yet.

A member, of the HJT Team, will examine the log and offer assistance.

Please be patient. It may take a while to get a response because the members of the HJT Team are very busy.
Please, be patient, this team is manned by volunteers. They will help you as soon as possible.

NOTE
Once you have made the post, please DO NOT make another post in the HJT forum, until it has been responded to by a member of the HJT Team.

The first thing they look for, when looking for logs to reply to, is 0 replies. If you make another post, it will show 1 reply.
A team member, looking to see if a reply has been made might assume someone is already assisting you and will not respond.

So, just make your post and wait for a response until a team member responds.

Edited by Enthusiast, 25 August 2005 - 10:30 AM.


#12 Face

Face

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 25 August 2005 - 03:58 PM

Well, i new here and logged in because i have the same problem.
I tried to empty the sxpdr32.exe file like said before and it works.The damm
thing stopped but it is still on my computer.
When i reboot now i can't see it anymore in my Taskmanager.

I'll take a look on how Hijackthis works and i post a report.

Thanx you all for your effort.
:thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users