Security

Ask something
Discussion Locked

Possible virus?

0 helpful
2 replies

by kingsfire

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I recently installed a firewall because I went from a dial-up to broadband connection to access the internet.
Needles to say I was quite suprised to find a program trying to access the internet when I started my computer.
The program is named wpbewvbb.exe.
It also seems to have something to do with launching notepad which also attempts to access the internet.
I did a little investigating and found out that the wpbewvbb program is set to launch from my windows ini file.
Could this be avirus or trojin?
To my knowledge I have no programs that need to access the internet when my computer boots into windows.

I intend to delete this file but I am not shure if it would interfere with windows or something else.

Any sugestionswould be appreciated.

2 replies

by albert franco ii

Notepad NEVER needs to access the internet!!! This is a trojan!

Some trojans hide behind names that look like Windows apps. Notepad.exe is a text reader that has no internet functionality. So if a program called notepad.exe is accessing the internet it is definitely a phoney!!!

As for the other program make a copy of it on a diskette then delete it from your hard drive. If it causes a problem then you can always put it back. The name is not familiar to me so I'm sure it's not a Windows program, but it could be part of some other application you have.

In any case, if you don't specifically know what it is you should disconnect it. It could be part of a spyware package collect information about your surfing habits or it could be copying your private files to some Chinese web site. How would you know?

Basic message: Be suspicious...

by madmark

Notepad has no need for Internet access. Scan your system with the latest anti-virus defs, preferably from a CLEAN boot disk or rescue disk. I assume that you are using ZoneAlarm or some other firewall. Deny the program access using the F/W. If nothing is broken, copy to floppy and delete the file from Harddisk. Please don't give the floppy to someone you love.

Your system have been compromised. Who knows how long this has been on your system and what it has been up to. Is it the ONLYfile that is compromised? Is it the only attack vector?

Personally, I would backup my data (DATA ONLY! No programs, no drivers, etc.) blow the system away, and start clean. Install the F/W and Anti-Virus software BEFORE you connect the network cable or restore the backup. But then, I am an unemployed, security conscious IT guy, and I sleep with one eye open and my backup against the wall...

This discussion is closed to new replies.