Deleted tvelwquped.exe due to a virus!! Now what?

MikeInOhio · April 29th, 2001, 10:10 PM

Norton Virus informed me that my tvelwquped.exe file had a virus .I took the option of deleting this file, and Norton informed me that all was now ok....no virus. BUT....I can't run any application because I get a box asking for this file, that it is needed to run an application.
First, is this file a 'real' file....or a trick of the virus? And two, if I do need it, and it seems I do, where can I get this file? Thanks so much for any help you folks give me.....I am very worried, it was my first infection....THANKS!

EDIT: The virus was "Subseven.22.plugin" I believe.

Sowulo · April 29th, 2001, 11:42 PM

Never heard of this file name. Searches on the web turn up nothing. Search at Symantec Virus Research site turns up nothing. Anyone else seen this?

furlong47 · April 30th, 2001, 10:04 AM

I have never seen this either, Sowulo. Web searches, McAfee and Symantec's virus librarys, and a search on my own system turn up nothing!

furlong47 · April 30th, 2001, 10:15 AM

On the other post, you said you thought it was Subseven.22.plugin. Here is the information about that virus:
http://www.symantec.com/avcenter/ven...even.22.a.html

It is possible this is what you had, since the program can have many different names. Check for the registry entry mentioned on the link above and remove it if it is there.

MikeInOhio · April 30th, 2001, 05:22 PM

Thanks for the help. I will go into some detail about what happened and how I fixed and deleted the virus.

The virus was actually 'Backdoor.Subseven22'. It changed and renamed 2 files of unknown origin in the windows folder to 'tvelwquped.exe' and 'bexqitdbeh.exe'. The 'tv*.exe' was picked up first by Norton Anti-virus. It could not be repaired, so I deleted it. I was then unable to open any application except I.E. 5.5 and Outlook E-Mail. This makes sense because the file change would effect applications yet the culprit with the interface on the other end would want the infected user on-line to take a look at the files on my system.

The second file 'bex*.exe' made the following happen: When I would go off-line, about 15 seconds later the modem would try to get me back on-line without my direction to do so. There were no open windows requiring information on-line or any other reason for this to happen. It would try four times consistantly to get on-line, even if I did not have automatic connect for the dialer. This file too was not repairable and was deleted. The above problem ended with the deletion.
I checked through regedit and sysedit a couple of files as directed by Norton to make sure they were clean, and fortunatly they were. I also had to re-install my Windows 98 so that the two files that were changed were back in the computer in correct status.

The computer is clean now. I'm so glad to have had Norton...without the anti-virus software I would have been a sitting target for those with the interface to hack me. Please let me know if you have heard of this, I'm going to send this info to Norton also. It may be a new strain of an old virus attack.

Again...thanks for the help!

April 29th, 2001, 10:10 PM	#1
MikeInOhio Junior Member Join Date: Apr 2001 Location: Barberton Posts: 6	Deleted tvelwquped.exe due to a virus!! Now what? Norton Virus informed me that my tvelwquped.exe file had a virus .I took the option of deleting this file, and Norton informed me that all was now ok....no virus. BUT....I can't run any application because I get a box asking for this file, that it is needed to run an application. First, is this file a 'real' file....or a trick of the virus? And two, if I do need it, and it seems I do, where can I get this file? Thanks so much for any help you folks give me.....I am very worried, it was my first infection....THANKS! EDIT: The virus was "Subseven.22.plugin" I believe.

April 29th, 2001, 11:42 PM	#2
Sowulo Registered User Join Date: Oct 1999 Location: Clackamas, OR USA Posts: 5,422	Never heard of this file name. Searches on the web turn up nothing. Search at Symantec Virus Research site turns up nothing. Anyone else seen this? __________________ "Badges? We don't need no stinking badges."

April 30th, 2001, 10:04 AM	#3
furlong47 Registered User Join Date: Sep 2000 Location: Kutztown, PA Posts: 234	I have never seen this either, Sowulo. Web searches, McAfee and Symantec's virus librarys, and a search on my own system turn up nothing! __________________ <a href="http://www.8ung.at/furlong47" target="_blank">Furlong47's Poetry Page</a> <a href="http://roadtrip.d-domains.net" target="_blank">ROADTRIP!!!</a> You know it's going to be a long day when you get up, shave and shower, start to get dressed and your shoes are still warm. -- Dean Webber

April 30th, 2001, 10:15 AM	#4
furlong47 Registered User Join Date: Sep 2000 Location: Kutztown, PA Posts: 234	On the other post, you said you thought it was Subseven.22.plugin. Here is the information about that virus: http://www.symantec.com/avcenter/ven...even.22.a.html It is possible this is what you had, since the program can have many different names. Check for the registry entry mentioned on the link above and remove it if it is there. __________________ <a href="http://www.8ung.at/furlong47" target="_blank">Furlong47's Poetry Page</a> <a href="http://roadtrip.d-domains.net" target="_blank">ROADTRIP!!!</a> You know it's going to be a long day when you get up, shave and shower, start to get dressed and your shoes are still warm. -- Dean Webber

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

April 30th, 2001, 05:22 PM	#5
MikeInOhio Junior Member Join Date: Apr 2001 Location: Barberton Posts: 6	Thanks for the help. I will go into some detail about what happened and how I fixed and deleted the virus. The virus was actually 'Backdoor.Subseven22'. It changed and renamed 2 files of unknown origin in the windows folder to 'tvelwquped.exe' and 'bexqitdbeh.exe'. The 'tv.exe' was picked up first by Norton Anti-virus. It could not be repaired, so I deleted it. I was then unable to open any application except I.E. 5.5 and Outlook E-Mail. This makes sense because the file change would effect applications yet the culprit with the interface on the other end would want the infected user on-line to take a look at the files on my system. The second file 'bex.exe' made the following happen: When I would go off-line, about 15 seconds later the modem would try to get me back on-line without my direction to do so. There were no open windows requiring information on-line or any other reason for this to happen. It would try four times consistantly to get on-line, even if I did not have automatic connect for the dialer. This file too was not repairable and was deleted. The above problem ended with the deletion. I checked through regedit and sysedit a couple of files as directed by Norton to make sure they were clean, and fortunatly they were. I also had to re-install my Windows 98 so that the two files that were changed were back in the computer in correct status. The computer is clean now. I'm so glad to have had Norton...without the anti-virus software I would have been a sitting target for those with the interface to hack me. Please let me know if you have heard of this, I'm going to send this info to Norton also. It may be a new strain of an old virus attack. Again...thanks for the help!