Unknown Program in Startup

An unknown program has been put into the startup in msconfig.
The path is:
C:\Users\%username%\AppData\Roaming\twext.exe
The name is 'userinit'. I have since deleted it from the Run key in the
registry and deleted the file, but was wondering if anyone has heard of
this?

Thanks,
James

"JamesJ" <jjy@darwin_roadrunner.com> wrote in message
news:...
> An unknown program has been put into the startup in msconfig.
> The path is:
> C:\Users\%username%\AppData\Roaming\twext.exe
> The name is 'userinit'. I have since deleted it from the Run key in the
> registry and deleted the file, but was wondering if anyone has heard of
> this?
>
> Thanks,
> James

<sigh>
Google is YOUR friend.......
http://www.google.co.uk/search?hl=en&q=twext.exe&meta=

Yes I know. I get lazy sometimes. Usually I do search the web
but I put more credence in the answers I get here.

Thanks much for the link.
James

"Gordon" <> wrote in message
news:...
>
> "JamesJ" <jjy@darwin_roadrunner.com> wrote in message
> news:...
>> An unknown program has been put into the startup in msconfig.
>> The path is:
>> C:\Users\%username%\AppData\Roaming\twext.exe
>> The name is 'userinit'. I have since deleted it from the Run key in the
>> registry and deleted the file, but was wondering if anyone has heard of
>> this?
>>
>> Thanks,
>> James
>
> <sigh>
> Google is YOUR friend.......
> http://www.google.co.uk/search?hl=en&q=twext.exe&meta=

I'm currently using AVG Free and it didn't seem to find anything earlier
today. I
didn't discover it unilt after I scanned.
Could this show up in Services and Processes? An if so will it be named the
same as in
the startup?


Thanks,
James

"JEWboy" <> wrote in message
news:...
> find that file in filesystem and delete ASAP.
> Then keep checking if it reappears in any form, for the next entire week,
> everytime you boot, check if it resurfaces as a file or Registry entry, or
> in MSconfig, or in Services.
> Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
> processes from all users" is checked.
> Check all processes for anything strange including this filename or its
> variations, if you see - kill the process tree.
>
> Run Antivirus immediately, then run AntiSPyware
> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
> in the world.
> One is NOt enough because they complement each other, make sure you set
> their settings to scan stealth items, rootkits, startup processes, etc,
> use your brain.
> I can't be at your computer to see what you doing wrong.
>
> Now listen.
> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
> antispyware tools AGAIN.
> AFter all done kjeep checking your system for any trace of this evil
> thing.
>
> I know sounds like you need to spend a life doing this crap, well it
> depends what you got on the computer. I design circuits for Military & US
> Government so I'd go at great length to cleanup my system, backup
> datafiles, and heck I will (but never did) even reinstall OS if I can't
> get rid of infection.

find that file in filesystem and delete ASAP.
Then keep checking if it reappears in any form, for the next entire week,
everytime you boot, check if it resurfaces as a file or Registry entry, or
in MSconfig, or in Services.
Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
processes from all users" is checked.
Check all processes for anything strange including this filename or its
variations, if you see - kill the process tree.

Run Antivirus immediately, then run AntiSPyware
My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools in
the world.
One is NOt enough because they complement each other, make sure you set
their settings to scan stealth items, rootkits, startup processes, etc, use
your brain.
I can't be at your computer to see what you doing wrong.

Now listen.
Shutdown, reboot into Windows SAFE mode, run those 2 antivirus & antispyware
tools AGAIN.
AFter all done kjeep checking your system for any trace of this evil thing.

I know sounds like you need to spend a life doing this crap, well it depends
what you got on the computer. I design circuits for Military & US
Government so I'd go at great length to cleanup my system, backup datafiles,
and heck I will (but never did) even reinstall OS if I can't get rid of
infection.

It depends on virus/spyware complexity, some are written as joke programs
and easy to detect, some continually vary their name so it takes an analytic
& highly technical mind to detect.

I killed a serious infection by using sheer reasoning, w/o ANY Antivirus s
everal years ago on coworkers machine. It took me many hours, though, he
had no AV and virus would not allow any Antivirus installation, shutdown his
Firewall and I was forced to unplug Network cable.
I could not load Antivirus thru USB media either, but I did kill infection
by manually examining the LATEST added files to Windows\system32, Windows
root, Temporary files, user\temp files, etc.
No tmany people can do this, but it's just my profession.

You know if my toilet breaks down, I am forced to call for a plumber, I am
clueless. But if computer breaks down, I do it by myself... so to answer
your question:

It MAY show up in services, running processes, startup items, etc as such,
or it may disguise with a variable name, or most commonly:
it copies a legitimate Windows filename so you can never recognize. Unless
you're like mhow spend s alife on computers.... I simply checked "date
modified" and separate a list of files changed on the day thi sman reported
infection, then backed down to a few days earlier just to make sure I catch
all bastards.

Then I checked filesize, and I found one file which was named as an
idientical legitimate Windows DLL library, BUT its size was lsightly
larger!!


Ah-ha I thought to myself, let's see if I replace it with a copy of
legitimate windows file. Well infection stopped, but it did screw up
Firewall forever, some TCP/IP stuff had to be reinstalled.

"JEWboy" <> wrote in message
news:...
> find that file in filesystem and delete ASAP.
> Then keep checking if it reappears in any form, for the next entire week,
> everytime you boot, check if it resurfaces as a file or Registry entry, or
> in MSconfig, or in Services.
> Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
> processes from all users" is checked.
> Check all processes for anything strange including this filename or its
> variations, if you see - kill the process tree.
>
> Run Antivirus immediately, then run AntiSPyware
> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
> in the world.
> One is NOt enough because they complement each other, make sure you set
> their settings to scan stealth items, rootkits, startup processes, etc,
> use your brain.
> I can't be at your computer to see what you doing wrong.
>
> Now listen.
> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
> antispyware tools AGAIN.
> AFter all done kjeep checking your system for any trace of this evil
> thing.
>
> I know sounds like you need to spend a life doing this crap, well it
> depends what you got on the computer. I design circuits for Military & US
> Government so I'd go at great length to cleanup my system, backup
> datafiles, and heck I will (but never did) even reinstall OS if I can't
> get rid of infection.

So how come under your alias Mark L you said only a couple of weeks ago that
the only reason you just started using vista is that your HP XP system got
trashed by nasties and you did not have a backup and had to rush out and buy
Vista? Can you even lie straight in bed?

Camper

Do you all know this person?

"Spanky de Monkey" <> wrote in message
news:rSe_l.65$...
> JEWboy wrote:
>> find that file in filesystem and delete ASAP.
>> Then keep checking if it reappears in any form, for the next entire week,
>> everytime you boot, check if it resurfaces as a file or Registry entry,
>> or in MSconfig, or in Services.
>> Then start TASK MANAGER, goto Processes, make sure checkbox next to "show
>> processes from all users" is checked.
>> Check all processes for anything strange including this filename or its
>> variations, if you see - kill the process tree.
>>
>> Run Antivirus immediately, then run AntiSPyware
>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated tools
>> in the world.
>> One is NOt enough because they complement each other, make sure you set
>> their settings to scan stealth items, rootkits, startup processes, etc,
>> use your brain.
>> I can't be at your computer to see what you doing wrong.
>>
>> Now listen.
>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>> antispyware tools AGAIN.
>> AFter all done kjeep checking your system for any trace of this evil
>> thing.
>>
>> I know sounds like you need to spend a life doing this crap, well it
>> depends what you got on the computer. I design circuits for Military &
>> US Government so I'd go at great length to cleanup my system, backup
>> datafiles, and heck I will (but never did) even reinstall OS if I can't
>> get rid of infection.
>
>
> You are delusional. You work the mop and bucket at Taco-Bell. You've
> been doing it for years, trying to get promoted to work the fryer. Your
> dream is working the counter.
>
> Think outside the BUN.

JamesJ wrote:
> Do you all know this person?

Spanky, aka everyone's psychiatrist, aka Bill Yanaire, ad nauseum is a
disgusting troll. Ignore him.

Alias
>
> "Spanky de Monkey" <> wrote in message
> news:rSe_l.65$...
>> JEWboy wrote:
>>> find that file in filesystem and delete ASAP.
>>> Then keep checking if it reappears in any form, for the next entire
>>> week, everytime you boot, check if it resurfaces as a file or
>>> Registry entry, or in MSconfig, or in Services.
>>> Then start TASK MANAGER, goto Processes, make sure checkbox next to
>>> "show processes from all users" is checked.
>>> Check all processes for anything strange including this filename or
>>> its variations, if you see - kill the process tree.
>>>
>>> Run Antivirus immediately, then run AntiSPyware
>>> My favorites are Norton AV + PCTools SPyware Doctor, the top rated
>>> tools in the world.
>>> One is NOt enough because they complement each other, make sure you
>>> set their settings to scan stealth items, rootkits, startup
>>> processes, etc, use your brain.
>>> I can't be at your computer to see what you doing wrong.
>>>
>>> Now listen.
>>> Shutdown, reboot into Windows SAFE mode, run those 2 antivirus &
>>> antispyware tools AGAIN.
>>> AFter all done kjeep checking your system for any trace of this evil
>>> thing.
>>>
>>> I know sounds like you need to spend a life doing this crap, well it
>>> depends what you got on the computer. I design circuits for Military
>>> & US Government so I'd go at great length to cleanup my system,
>>> backup datafiles, and heck I will (but never did) even reinstall OS
>>> if I can't get rid of infection.
>>
>>
>> You are delusional. You work the mop and bucket at Taco-Bell. You've
>> been doing it for years, trying to get promoted to work the fryer.
>> Your dream is working the counter.
>>
>> Think outside the BUN.
>

Frank wrote:
> Oops!
> Well alias, you can't keep your lying stupid mouth shut can you? You
> only dig deeper into that abyss of lies you call your life.
> Print this out and have a responsibility adult explain it to you.
> #1 lie from alias is:
> pushing linux as an alternative to Vista in this Vista ng is "on
> topic"...Hahahahaha...YOU SICK ****!!!
> #2 lie from alias is:
> ..."I do not spam this ng with ubuntu spam"
> #3 lie from alias is::
> ..."I am not trolling this Vista ng with linux/ubuntu bullshit"...Hahaha!
> #4 lie from alias is:
> ..."I make $14,000 per week"...Hahahaha...you lying sick ****!
> #5 lie from alias is:
> ..."I was in the 101st U.S. Army Airborne Division"...Hahaha!
> #6 lie from alias is:...
> I am not a liar"!...Hahaha!

All of the above are not lies. You saying they are is a LIE.

>
> Want some more you LYING SICK ****!!!

In order to have more, you have to have some. When you have ONE lie, get
back to me. You, OTOH, lie constantly.

Alias