Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Continous Errors


  • Please log in to reply
18 replies to this topic

#1 aircraftdude

aircraftdude

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 14 December 2005 - 04:52 PM

hi, every time I log in to windows, I am greeted by these two fellows:

Posted Image

The spyware infection thing has become my permanent wallpaper, and the ibm00001.exe thing pops up EVERY time the desktop first loads. It really is annoying. What can I do?

I have gotten rid of all the spyware/viruses/adware on my PC, using Webroot, Superad destroyer (or something like that) and Norton Internet Security 2006. No difference.

PLEASE HELP!

:thumbsup:

Best Regards,

Odai Koukash.

BC AdBot (Login to Remove)

 


m

#2 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:01:02 PM

Posted 14 December 2005 - 06:11 PM

Welcome to BC aircraftdude.
You need to go to this link, http://www.bleepingcomputer.com/forums/t/34773/preparation-guide-for-use-before-using-malware-removal-tools-and-requesting-help/ , and read ALL of it. It will walk you through the steps one by one. If you do extarctly what it say, you should be spyware/virus free is a short while.
Good luck.

Edited by acklan, 14 December 2005 - 06:12 PM.

"2007 & 2008 Windows Shell/User Award"

#3 aircraftdude

aircraftdude
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 15 December 2005 - 03:19 PM

hello, thankyou for your help. However, I defintely do not have any spyware on my PC. That is why I find it annoying that it is still telling me I do. I have used several different programs, including hijack this, but it won't go away (BTW, this is only happening on my user account, the others are not affected by this 'permanent wallpaper'). I have tried to change my wallpaper, but no luck. It won't let me click in the area in which you choose which wallpaper you desire. As for the 'ibm0000.exe' meesage I get, will the instructions you gave me in that link actually help me get rid of it?

By the way, I remember deleting a file called 'ibm0000.exe' because it was identified as spyware.

Thanks again!

Edited by aircraftdude, 15 December 2005 - 03:20 PM.


#4 Albert Frankenstein

Albert Frankenstein

  • Members
  • 2,707 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Michigan, USA
  • Local time:03:02 PM

Posted 15 December 2005 - 05:20 PM

aircraftdude, you do indeed have spyware installed on your computer. acklan is right on the money on this one. It is the spyware itself that is giving you the 'spyware is installed' message and not allowing you to change the wallpaper.

Follow acklan's instructions and you can get it clean again!
ALBERT FRANKENSTEIN
I'M SO SMART IT'S SCARY!


Currently home chillin' with the fam and my two dogs!


#5 aircraftdude

aircraftdude
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 06 January 2006 - 11:36 AM

hello, sorry for the very late reply, I've been very busy. I will try acklan's instructions again, but I still have no idea how to get rid of the 'ibm0000.exe' message I get! :thumbsup:

#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,072 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:02:02 PM

Posted 06 January 2006 - 12:23 PM

By following acklan's instructions, you'll get the assistance of the antispyware experts. And they will tell you how to get rid of this by using their antispyware tools.

Then, if there's still problems with your system (sometimes the viruses/spyware have destroyed important system files), they'll refer you back here and we'll work with you to restore things to normal.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#7 Exile4eva

Exile4eva

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:02 PM

Posted 07 January 2006 - 10:02 AM

Hi,

I've never posted here before so don't have a credible reputation but if you follow my advice I can definately help you get rid of the 'ibm0000.exe not found' message on start-up. :thumbsup:

I assure you my solution (although involving the removal of a registry entry) is completely safe.

The presence of ibm0000.exe is due to having been infected with the TORPIG-C virus.

The reason you see the message that it cannot be found (even after removal) is because the system has been told to automatically load it upon startup, even though it has been removed.

To remove this error message you will need to click your start menu, then click run and type "Regedit" (without the quotes) into the run box. Then press enter.

Once in the registry you will need to navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Inside Winlogon (inside the window to the right) you will find a an entry with the name Shell. The Shell entry is used to load programs automatically on start-up. At first it will appear that Explorer.exe is the only program present in shell but after double clicking "Shell" entry you will something similar to this in the "Value data" section:

"Explorer.exe C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm0000.exe"

You need to remove the 'C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm0000.exe' entry so it just reads "Explorer.exe" inside the shell folder. After doing this exit the registry editor and reboot your computer.

Upon reboot the message should be gone. :flowers:

Hope this helped.

- Sam.

Edited by Exile4eva, 07 January 2006 - 11:35 AM.


#8 acklan

acklan

    Bleepin' cat's meow


  • Members
  • 8,529 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Baton Rouge, La.
  • Local time:01:02 PM

Posted 07 January 2006 - 10:34 AM

Welcome to BC Exile4eva
"2007 & 2008 Windows Shell/User Award"

#9 Exile4eva

Exile4eva

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:02 PM

Posted 07 January 2006 - 11:35 AM

Welcome to BC Exile4eva


Thanks! :thumbsup:

#10 aircraftdude

aircraftdude
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:07:02 PM

Posted 09 January 2006 - 04:56 AM

well, I managed to get rid of the ibm0001 message, so thanks a ton Exile4eva! I'll try out Acklans instructions now to get rid of the spyware...

#11 Exile4eva

Exile4eva

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:02:02 PM

Posted 09 January 2006 - 01:43 PM

well, I managed to get rid of the ibm0001 message, so thanks a ton Exile4eva! I'll try out Acklans instructions now to get rid of the spyware...


No worries! :thumbsup:

#12 Kruncher

Kruncher

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:01:02 PM

Posted 23 January 2006 - 12:47 PM

That back ground is caused by one of the Windows WMF exploits.

To remove it, follow the instructions from this site: http://www.help2go.com/Tutorials/Spyware_I...xeFix.exe).html

After the reboot everything should be back to normal.

Hope this helps.

Oh P.S. check out http://noahdfear.geekstogo.com/ for smitREM.exe's home page.

Edited by Kruncher, 23 January 2006 - 03:56 PM.


#13 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:02 PM

Posted 23 January 2006 - 06:15 PM

That back ground is caused by one of the Windows WMF exploits.


Kruncher, i'm not questioning you, but this background was around was before the WMF vunerability. It probably isn't caused by it in my opinion.

You've given the instructions to remove Spyaxe, but i don't see spyaxe, i just see a smittrojan infection.

I recommend BC's own guide which can be found here: http://www.bleepingcomputer.com/forums/t/22402/how-to-remove-spysheriff-winstallexe-spysheriffexe/

It demonstrates a very similar picture to the one that aircraftdude posted. I don't recommend Help2Go (that's just my opinion though :thumbsup:)

David

Mod Edit: Enabled link ~S

Edited by Scarlett, 23 January 2006 - 06:29 PM.


#14 Kruncher

Kruncher

  • Members
  • 45 posts
  • OFFLINE
  •  
  • Local time:01:02 PM

Posted 23 January 2006 - 07:15 PM

Oh D-Trojanator, I'm sorry. At the computer place I work at, I was reading the latest digg article which was about the WMF exploit and had that picture. That very same day we had a computer come in with the same characteristics. A little googling came up with that Help2Go page and the fix has worked on every computer that has come in with the same background and/or system tray popup.

Edited by Kruncher, 23 January 2006 - 07:18 PM.


#15 -David-

-David-

  • Members
  • 10,603 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:London
  • Local time:08:02 PM

Posted 24 January 2006 - 12:58 PM

:thumbsup: Sorry if i came across a bit mean then :flowers: Maybe i could have added some more smiley emotions. I just meant that it would be easier to give links to the sites own tutorials if they are available.
David




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users