O/T - Adult Website Pop-Up Follow Up

[Guest Joshieca]

Since my original thread was moved to hardware/software I just wanted to post a follow up and a big thank you to all who offered suggestions for eradication of this "virus". Its been more then 48 hours since the last the occurrence so I think that its safe to say that I found the problem program and have successfully removed it....without having to loose data or format my drive. :) In case anyone missed the topic and also so someone else doesn't have to go through it, I wanted to post how I got it again for your reference.Basically what I can remember happen is that I paid a visit to a website which launched a download requester to install a new "enhancement" for IE. Upon choosing NO the window requester closed but launched a small JAVA script that left a "pop-under" window open. I went to a few other websites without incident. It wasn't until I came to another download requester from AVSIM (not AVSIM's fault) that this "pop-under" JAVA script became active. When the download requester for a file from AVSIM opened up, this little JAVA script opened up over the one from AVSIM. Not paying attention I accepted this download. Upon its completion it installed some files onto my computer. I didn't know this had happened until I started to see pop up ad's for adult website's. I didn't even have to have IE open, it would still pop up. This would happen several times a day and then it would stop, only to return once again the next day. After a long several days I finally found the little "virus" program that was installed. It is a file called taskmgr.exe. It masquerades itself as the Windows Task Manager....launching each time your computer restarts in the background. When you bring up the Window's Task Manager and unless you pay real close attention you would think that there was nothing strange running....only there were TWO taskmgr.exe files running. The real one should be in C:Windowssystem32 (WIN XP). This fake one ("virus") was in C:Windows Once I removed this fake taskmgr.exe from my C:Windows directory and removed the REGEDIT keys for it, all was solved.Thanks again......Josh