desktop Icon Problem

[givetoget]

I have a HP with Windows xp, There is an icon on the desktop I cannot get rid of. It is a white box with a blue line on top, it has the letter(a) under it. I use norton security, Ive tried rebooting in safe mode, and a couple other different things recommended to me but just cannot get it deleted. When I try it says it is being used by some other program but Im not using anything else. Under properties it says it is an a.exe file,but it is an empty file. can anyone help with getting rid of this thing. Any help would be appreciated.

Thank You,

[Scott K]

Dump it into a folder. Out of site, out of mind. Or cant you even move it?

[upnorth]

Sounds like a virus or malware. Reboot the PC into safe mode and run a Virus scan and something like malwarebytes or combo fix.

[givetoget]

Dump it into a folder. Out of site, out of mind. Or cant you even move it?

No I cant move it, I cant do nothing with it.

[givetoget]

Upnorth, that what I was woried about was a virus or something... Ever since this came up I cant open my HP director for my printer. Also I cannot do a recovery to an earlier date.

[upnorth]

Safe mode and then virus and malware scans is your best bet. I googled a.exe and as I suspected a few virus and malware resolutions were returned. Don't feel bad I spent most the day remotely scanning PCs at work because of an outbreak of some dang worm. USB drives can be a PITA for bring viri into normally secure places!!

[givetoget]

OK, Thanks upnorth, Ill give that a try on friday. Ill post back with results.

[brainard6]

Ok I have a kind of a stupid question. How does one reboot their computer to the safe mode? What is the difference of running virus scan in safe mode or in the normal mode?

[upnorth]

To get into safe mode you tap the F8 key while booting up. Safe mode only starts a bare minimum of Windows to be able to run some basic troubleshooting. Normally won't load the malware or viruses that have infected your PC, many of which when fully loaded are resistant to removal.

[pureinsanity]

if you right click on the icon and hit properties does it say the file name is a.exe? if so, you have the W32.Ahlem.A@mm worm which is transmitted via e-mail and attempts to install itself on your computer. It is a security risk and should be removed from your system.

What happens when you open your internet browser? Do a google search for something and let me know if it opens up a new tab to a different HSOforum...

One thing you can try is Press Ctrl + Alt + Delete to open the task manager.

Go to the processes tab. You will see a list of processes running. At the top you will see something that says "Image Name" Click on that and it will alphabetize the processes from a - z. Once you do this do you see a.exe? If so click on it once, and then select end process. Then go to your location where you saw the icon and try and delete it now.

The reason it won't let you manually delete it is because its being run in the background as a windows process slowly leaking information. If you end the process you should be able to delete the file under most circumstances because that file is no longer being run.

Lets hope its is as simple as that. sometimes after a reboot you will see it reappear. this just means there is a start up file that is starting up on power on. If that is the case we will take another step. Try this option first.

[upnorth]

I am pretty sure it won't be. Most are set to reinstall themselves. You need to get the service it starts etc out of the registry and the install files it uses. Ccleaner helps too. I only wish getting rid of that stuff was that easy.

[Scott K]

Malwarebytes will remove the majority of the viruses, or worms.

[pureinsanity]

I am pretty sure it won't be. Most are set to reinstall themselves. You need to get the service it starts etc out of the registry and the install files it uses. Ccleaner helps too. I only wish getting rid of that stuff was that easy.

The most difficult one I had was hidden in a fonts folder. It had a start up item causing it to regenerate and I noticed it was going to the fonts folder. Tricky spot to hide something since most of us don't go into the fonts folder. But it stuck out like a sore thumb when I opened the fonts folder

Little msconfig and change the start up I was able to manually delete it and not have that pesky ini file start up every time the computer turned on. No need to clean the registry if done this way, well you shouldn't have too.

[upnorth]

1 helpful tip is to delete everything in C:\windows\prefetch a lot of these apps use that folder to put their reinstall files in. And there is nothing in there that is critical. You can even delete the folder and windows will create it again at start up.

[itchmesir]

Run>Regedit..

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

(sometimes they will install to RunOnce)

^^^^ is a good place to look if you don't have a good cleaner.. you can look in this area for a.exe... then it'll tell you where the program is running which will allow you to remove the program.. if i remember correctly..its been awhile since ive had to remove a virus.. it goes like this:

Remove registry entry

End Program via Task Manager

Delete program

[givetoget]

Thanks for the replies everyone. I have some time tonight so Im going to try a few suggestions

Itch, Thanks but I did not find it in there.

Upnorth, Idid delete that prefetch file and rebooted, no good.

Pureinsanity, I did not find it in the task manager.

Here is some more food for thought. Now on the desk top There is another icon it looks like this

MS

DOS with the letter a under it.

When I right click on these icons then properties, then click on the general tab it is title as just the letter (a) but if i click on program tab under properties its titled as (a.exe) The size is 0 bytes

Sorry for being long winded here LOL, I do appreciate the help and Im learning a few things here at the same time.

Thanks TRB,

[upnorth]

I meant that as a preluded to running the AV and malware scans.

[givetoget]

THANKS Purinsanity,

I did not find it in task manager.As far as searching for things, I can do that, although sometimes its slow almost difficult at times but never sends me to a different site. Any other ideas are most welcome

Thanks

[givetoget]

upnorth i understand now, sorry. For these PC cleaners like ( malwarebyts) and others, what one does anyone recommend. Is the trial version enough or do I have to buy the full version.Do they do what they claim,(clean it, speed it up and such) I guess what I dont understand is I thought thats what my norton security was supposed to do.

Thanks

[upnorth]

Trial demo version will be fine, combo fix is a good one too. Both can be had free off the web. And yes the malware/virus thing can be a huge PITA.

Yeah they clean things up pretty good and get rid of junk that slows them down especially on the web.

Side note: If you go to a site and it says you need to install something to see the site properly don't download and install from there. Go to reputable site and download and install from there. But even then be sure this is something you need.

[givetoget]

update: I did as you suggested upnorth, I downloaded malwarebyts, rebooted in safe mode, did malware scan, did a norton antivirus security scan and that little bugger is still there. Any other ideas are welcome and thanks everyone for the help.

[itchmesir]

ha.. you got problems.. yesterday i downloaded the update for 7 on my school laptop and something f'ed it.. cannot even boot

[Scott K]

If you dont have valuable stuff that you cant loose, do a clean install. ptherwise save everything you need, then do a clean install, beast option at this point.

[upnorth]

try combo fix. Malwarebytes is good, but there are things it it won't get. I am not sure how much you have on your PC, but if you have a simple install with few extra apps it may be easier to format and re-install, that is if you have the install cds/dvds or restore partition.

Also found this on the web.

Quote:

HOW TO REMOVE MONOPOD (A.EXE/B.EXE/C.EXE), AND HOW TO REPAIR WINDOWS DEFENDER, FIREWALL, SECURITY CENTRE AND BACK-UP (UNDER WINDOWS VISTA SP1, BUT PROBABLY ALSO WORKS UNDER OTHER WINDOWS VERSIONS)

Monopod is a new malware (a Trojan), of which the following malicious actions have (already) been reported:

• Semi-permanent deactivation of Windows Defender, Firewall, Security Centre and Windows Back-up

• Redirection of browsers to unwanted sites

• Facilitation of installation of other malware

HOW TO REMOVE MONOPOD AND OTHER MALWARES:

1. Windows key + R(un) > type in: msconfig > OK.

2. In the appearing window, under the tab “Start-up”, de-tick all files with an undeclared/unknown manufacturer, and files that are otherwise clearly malware. Click OK.

3. Reboot the computer.

4. Update your virus scanner. If you don’t have one, install one. I would suggest AVG Anti-Virus Free (http://free.avg.com/). Reboot if necessary, and let the anti-virus program scan the computer completely (also scan external drives if they have been attached in the meantime). If it doesn’t find any malware files, keep it running because sometimes it recognizes files only when they become active.

5. If MalwareBytes Antimalware does not find/remove all malwares, download and install the latest version of the Microsoft Malware Removal tool, available on http://www.microsoft.com/security/malwareremove/default.aspx. Disconnect from the internet. Let it do a complete scan as well, even though this can take several hours. It will automatically delete detected malware files.

6. Any remaining computer booting problems under Vista can usually be fixed with Vista Recovery Disc (start here: http://neosmart.net/blog/2008/windows-vista-recovery-disc-download/).

HOW TO REPAIR (REACTIVATE) WINDOWS SECURITY CENTRE, WINDOWS DEFENDER AND WINDOWS FIREWALL:

1. Windows key + R(un) > type in: services.msc > OK.

2. In the appearing window, scroll down to Security Centre. Unless the status reads “Started”, double-click it. In the new window, under the tab “General”, set the start-up type to Automatic. Also click the Start button, then OK.

3. Scroll down to Windows Defender and do the same for it, as well for Windows Firewall.

4. Reboot (only) if necessary.

HOW TO REPAIR (REACTIVATE) WINDOWS BACK-UP:

1. Right-click (This) Computer > Properties (> Change settings).

2. In the appearing window, under the tab “System properties” (or a similar name), re-tick your normal drives [at least your main drive, generally “Local Drive (C:) (system)”]. De-tick the bogus main drive (also called C:, generally) that Monopod had wanted Windows to believe was present. You will see the difference between the two, and if not: the bogus drive is the last in the list. Click OK.

3. Monopod also deletes already made back-ups. Only experts with special programs can get these back. Make a new back-up (on an external drive, of course) when you are satisfied that your computer is functioning normal again.

Hope this helps. Please leave feedback if you have applied this instruction, including Windows version.

[Jim Almquist]

Another good software that has been the only one to fix two different computers is tdsskiller by kaspersky. It won't fix all your problems but it might just fix this one.

If you do decide to wipe it clean and start fresh make sure to scan all the files you save so you don't reintroduce the malware back into your computer.