Fucking Malware.

[ProfessorPap]

I have all of that. The problem is that the infection had progressed so far it's becoming impossible to get rid of totally.

you've actually tried hijackthis?  if so, it meant you submitted the diagnostic summary to a forums of helpers and assorted experts.  i'd be astounded if they didn't have something constructive to say.  this is what makes hijackthis so different from all the self-contained checkers out there.  if you haven't tried that method yet, start here:
http://www.tomcoyote.org/hjt/

otherwise, i like blarg's suggestion.  safe mode is a great place to make changes without being held back by programs or the system.  disconnecting your ethernet cable at the same time is nice because it prevents any bot programs from reporting back to their master.

anyway, i tried searching on "ru.exe" and it looks like it's an adult content dialer masquerading as a quicktime component.  the easiest way i've found to deal with this stuff is just to google it and see what other people (and what experts) recommend to get rid of the problem.  the only time i didn't have success with this method is when i got a bot program that kept randomly-generating filenames upon bootup, in which case i had to keep quarantining and searching until i finally found the root bot program.

http://www.google.com/search?q=ru.exe&sour...:en-US:official

[Icarus]

Stop dissin' on Internet Explorer.
I don't have spyware. I never get spyware.
I use this computer 24/7. I don't sleep, I don't eat.

How come I have 0 spyware?

I had an argument about this 2 days ago and some guy told me to run an adware scan. I sent him the log, the only thing adaware found was Alexa, which comes standard with internet explorer, and it's not even malware. There were of course tracking cookies.

3 weeks!

I spent those 3 weeks on this chair.. IE gave me no adware. How?

Maybe I surf smartlier than most people?

Anyway, don't blame IE for spyware, blame yourself. THX.

Exactly.


Seriously, I don't get spyware or virus shit through I.E. You shouldn't be going to a suspicious site in the first place. & everyone who's been in the emulation scene knows that more than 80% of the sites out there are fake.

By the way, kitty. http://www.gpemu.cjb.net is probably the best emulation site I've been to, ever. As far as I know it's still running, though that was about 3 months ago, & was the site I used for more than a year.

Storm got a new URL, so now its www.emugp.com. And well, the new Java download applet doesnt work for some people.

[Ramza]

If you still have problems, HiJackThis works great. You don't have to wait for people to tell you what to delete; all you need to do is look at the file extension that HJT gives you. For example:

O4 = Global Startup: Acrobat Assistant.Ink = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

If you look at the last extention, it shows the executable file acrotray.exe. Since it is obviously from Adobe Acrobat reader, you know it is not malicious and therefore shouldn't be deleted. However, if you encounter an unfamiliar file, you should google the exact name of the file. A lot of websites give detailed information about whether the file is a threat to your computer.

[frakk2000]

I am to lazy to read what the others suggested, but the Microsoft (Yes I know) Anti Spyware is actually pretty good, both finds and removes Spyware. And its free.

Oh and it has a real time scanner for any pages with spyware

[creedo]

The solution to having specific processes like ru.exe and nrpl.exe is to first remove them from the startup in msconfig, second to do a search for those 2 files and delete them, and last but most important to do:
start --> run --> regedit
Search --> [ru.exe or nrpl.exe]
When you find an entry, delete it. Don't worry, although deleting registry entries is generally considered risky, any entries related to these 2 viruses can and should be deleted.
Hit F3 after finding an instance to continue searching through the registry. Make sure you're searching the entire registry (highlight my computer on the left), not just one branch. Keep hitting F3 until it fails to bring up any more results.
Do this for both exe's.

Lastly, you can spot persistent hidden connections to other internet sites... connections created by adware/spyware.

Start --> run --> command (click OK)
Type netstat
You'll see a list of connections. At least one of these will be to yourself, others will be to various web sites you're browing. If you see something like aaa.screensavers.org or adulthosts.com or something else that sounds fishy, then you know that you're still in trouble.

To fix this (and you should do this even if you don't see any weird connections):
Start --> find --> files or folders ... search for "hosts" without the quote. The file you're looking for is just called hosts, no extension, just hosts. It'll be in your windows folder. Rename it "hosts.txt" and open it (wordpad or notepad are fine).
You'll probably see entries to a lot of spyware/adware sites. At the top, just after
#
# [Misc Add-ons][A - Z]

you'll want to put in this line:

127.0.0.1 localhost

Which ensures the computer's localhost is defined as itself, and not some spyware site.
You can probably safely delete the other entries, although I never bothered.
Save the changes, close out of hosts.txt, and rename it back to just "hosts".

If you don't already have a process viewing application, you should get one. Processes can run in a way that hides them from task manager (ctrl+alt+delete), and to see them you need a proper viewer. Windows 95/98 users can use pview95.exe, which is part of a kit but I'm hosting it here:
http://creedo.gbgl-hq.com/pview95.exe

You can see what's running, google everything you don't recognize, and take the appropriate steps above for everything that isn't kosher.

Once you're sure you've cleaned stuff out, reboot, check the process viewer, and check startup stuff through msconfig again.

[GujuSol]

I just recently got raped up the ass by a fucking Trojan... -_-

I think you should reword that.
It just doesn't sound right.

[Satoshi]

PWNED.

[cyberpimpbot]

I also don't see how anyone can single out IE for being the single source of spyware/adware/malware. It's all in how you computer and browser is configured.

Anyhoo, if you want any cartridge roms, there's only one site you really need (excluding GBA roms): Edge|emu There's a lot of popups and and such, but that's what keeps the site free and they have literally THOUSANDS of roms for dozens of systems, including public domain roms, and they've been verfied by the site's owners. :

Check out ROMshare at [url]http://gbxemu.com[url], although it's less safe since anyone can post anything they want romwise, so you need to be careful of your choices for downloading.

Oh, if you're running XP, find your prefetch folder and delete everything in there. They're just cache files that help speed up booting, but stuff can get planted in there.

[Xenogear]

Its nice that we have so many people who can help out.  I came in here thinking I would suggest Hijackthis and its already been said.

Yeah, the last trojan I had destroyed my computer completely and I had to kill it.  

[Kitty]

The Ru.exe or nrpl.exe are not in the msconfig, nrpl has been terminated from the registry, but the RU.exe is the problem. I can't find it anywhere. And it just spawns nrpl and re-adds all the values and files I got rid of, then kills it's own process. Time to do some system32 directory hunting. It's my last real idea.

Edit:****. I found Ru.exe in the windows folder. I'll get rid of it, destroy nrpl, and see what happens.

[GujuSol]

Good luck. And my advice is not to download roms, or look at porn, becuase my neighbor did both, and he had to get a new computer.  

[ltlatimer]

Nothing wrong with downloading roms from a non retarded site, you know.

As for porn, she's a girl. Do girls look at porn? (much) I don't think so.

[-SF-]

Its pretty much this step for me, Adaware -> Spybot Search and Destroy -> Giant AntiSpyware (not calling it MS) -> Avast -> AVS -> HiJackthis -> Reformat

If i'm lazy i just go to the last step and im set.