[RESOLVED] Lost file rcbrbvaud.exe ??????

[CleverJake]

Norton Anti-Virus found an infected file called rcbrbvaud.exe. As it was unable to clean it I deleted the file. Now, upon booting, I get a message that it wants to find that file (or a component of it) but can't. I've been searching the registry for it, but can find no signs of a reference to it. Norton Utilities knows it's missing, but doesn't know what to do about it. I've tried looking at the Windows 98 utility that allows you to avoid loading startup applications, but while the file is on the list, I have it unchecked as something to load. I think it's related to Pc-cillan which I no longer use. I've tried reinstalling and uninstalling that program with no difference. In short, I can't figure out why Windows still expects to find it. In failing to stop Windows from looking, I'm now searching for the file itself. I can't find it on the net or anywhere else. Can anyone help me to stop that annoying popup message? Do you know how to stop Windows from looking for it or do you know where I can get the replacement file? I don't even know if it'sa Windows file or something specific to another program like Pc-cillan.

[Compugeek]

One thing you can do is look where the file is located. What directory is it in? It may help you to decide what program it's from. Kinda have to play Sherlock Holmes. Once that is discoverd, you might be able to load, reload etc.


------------------
"Here phydeaux here boy"

[CleverJake]

File is all gone. It used to be in the C:\Windows directory. Another dead end for me!! My friend had a similar problem, and I couldn't help him with it either.



[This message has been edited by CleverJake (edited March 14, 2001).]

[3fingersalute]

Some viruses load in the run key, some in the run services, under both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE under software\microsoft\windows\current verstion\

They will also load in the system.ini under shell= and in the win.ini under run=

Another place to look is in the registry under HKEY_CLASSES_ROOT\exefile\shell\open\command
(a lot of the newer ones load up through this key!)

Also, try doing a search of the windows directory for files containing text with the filename that was infected

------------------
Is it because light travels faster than sound that some people appear bright until they speak????

[CleverJake]

Yahooooo!!!! It was hiding in the system.ini right near the beginning as shell=Explorer.exe rcbrbvaude.exe. Don't know how I missed it. Thanks!!!

[3fingersalute]

Seen quite a few loading this way lately, ever since the Navidad!

------------------
Is it because light travels faster than sound that some people appear bright until they speak????

[Antimatter]

nicely done man

------------------
"IT BURNS...IT BURNS"