Should I let this program run?

[Oifish]

Kerio Personal Firewall is telling me that hp72F4.tmp is trying to run DXOLE32.exe. Should I let this run or is this a security threat?

 

[jkoon]

I googled dxole32.exe and didnt find anything. Spyware?

 

[Oifish]

Yea i tried that too, with no results. So i think i might deleted it. My roomate did a search for those files on his PC and they didn't show up, so..... DELETED

 

[Oifish]

Well, I deleted these files and about 2 hours later the same thing popped up. Hmmm. I really dont want to let it run this program because I don't know what it is.

Hmm it seems like this only happens after Windows Media Player is open. And if I hit deny, it says the hpe71d is trying to run cmd.exe. Now I know that cmd.exe is legit, but mabye it will try to run a .bat file or something from there.

 

[gorcorps]

sounds like what I get w/ my hp printer software... do you have an hp printer?

 

[Oifish]

No, I don't even own one. I use a flashdrive and use the university's printers. I searched for dxole32 in regedit and it comes up with it in: HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603

Is that the legit Search Assistant, or is that the spyware. Because this is located in C:\windows\srchasst\

 

[screw3d]

Originally posted by: Oifish
No, I don't even own one. I use a flashdrive and use the university's printers. I searched for dxole32 in regedit and it comes up with it in: HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603

Is that the legit Search Assistant, or is that the spyware. Because this is located in C:\windows\srchasst\

Sounds like spyware to me..

 

[mechBgon]

What antivirus software are you using, Oifish? Brand and version.

 

[Oifish]

I'm using AntiVir XP, with AntiVir Guard running, and it is fully updated.

 

[biostud]

You should definately try some anti-spyware. Maybe alos run an online virus spywarescan, ex. Trend Micro.

 

[Oifish]

Oh, I have. I normally use Spybot, and Adaware, and HijackThis. Using Hijack this I found that hp72F4.tmp ia overwriting my Internet Exploer's homepage to some site that is "blocked" and you need to download the "anti-spyware" program to view it. The website it sends me to is http://updatecenter.com (ha ha ha nice try). But when I deleted that using hijackthis it still comes back. I use FireFox so I never noticed that before.

 

[Oifish]

Ahhh, I did I search for NVCTRL.exe which was also showing up in HijackThis and I found this site: http://www.mytechsupport.ca/support/topic.asp?TOPIC_ID=9978
I'll try what they say and get back to you guys.

 

[Oifish]

Alright it worked, that junk is gone. But now my desktop has the Windows ME look to it. I tried to change it back but it looks like the XP style is erased??? Should I just reinstall windows?

 

[mechBgon]

First try this: right-click & save target as. Follow the directions precisely, and PM me the results if you want a hand figuring out what they mean.

 

[Oifish]

I ran that, and it did not find anything wrong. I just think the XP theme got erased somehow. Is there a place that I can download this from?

 

[Frodolives]

Though I'm not expert on the subject, here's a thread that may interest you.

http://www.tribalwar.com/forums/showthread.php?p=9040093#post9040093

 

[Oifish]

I just copied the windows/resource/themes folder from my roomie's pc to mine and now it works fine, but some of the other looks are pretty intnense... Thanks for all your help guys.

 

[Oifish]

Well crap, this thing keeps popping up. I go through all the steps to delete it in safe mode like that link told me and still, Kerio is telling me that hp72F4.tmp is trying to run DXOLE32.exe. ARGH, there is something out there that keeps creating this program. Spybot, adaware, hijackthis, AntiVir, Mcafee, they all don't find what ever this stupid thing is.
Please Help!!!