Virus or Worm???

Can someone please help?? I am running winxp and have a problem with
intermittant crashing or disconnection from the net. When I connect a black
screen pops up with the heading: 16 bit ms-dos Subsystem and then
Locals~\temp\SurFairy~\.EXE When I press close it goes away. I have been told
this is spyware. I run McAfee virus protection and MS firewall both are upto
date. I have reinstalled windows to factory settings 5 times and still have
the problem. I am such a novice and would appreciate and advice. Oh, and my
modem drivers always need to be reinstalled when I start up the PC.

Novice,

See if the information at the following site is helpful;

http://www.spyany.com/program/articl..._Surfairy.html

--
Sir_George


"Novice" <> wrote in message
news:0C34E147-BDFB-4CB6-8607-...
> Can someone please help?? I am running winxp and have a problem with
> intermittant crashing or disconnection from the net. When I connect a
black
> screen pops up with the heading: 16 bit ms-dos Subsystem and then
> Locals~\temp\SurFairy~\.EXE When I press close it goes away. I have been
told
> this is spyware. I run McAfee virus protection and MS firewall both are
upto
> date. I have reinstalled windows to factory settings 5 times and still
have
> the problem. I am such a novice and would appreciate and advice. Oh, and
my
> modem drivers always need to be reinstalled when I start up the PC.

In the future, learn to post in the RIGHT News Group as what you ask has nothing to do with
Windows Update !

AUTOEXEC.NT Fix Method 1:
copy; c:\windows\repair\autoexec.nt
to
c:\windows\system32


AUTOEXEC.NT FIX Method 2:
Go to; Start --> Run
enter; cmd.exe

{ assuming the WinXP CDROM disk is in drive "D:" }
In the Command Prompt enter...
expand D:\i386\autoexec.nt_ %windir%\system32\autoexec.nt


Since there are many forms of malware that can cause a problem with AUTOEXEC.NT, please
perform the following...


1) Download the following three items...

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Pattern File.
http://www.trendmicro.com/download/pattern.asp

Adaware SE (free personal version v1.05)
http://www.lavasoftusa.com/

Create a directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")

Download Sysclean.com and place it in that directory.
Download the Trend Pattern File by obtaining the ZIP file.
For example; lpt394.zip

Extract the contents of the ZIP file and place the contents in the same directory as
sysclean.com.

2) Update Adaware with the latest definitions.
3) Disable System Restore
http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
4) Reboot your PC into Safe Mode
5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
platform and clean/delete any infectors/parasites found.
(a few cycles may be needed)
6) Restart your PC and perform a "final" Full Scan of your platform using both the
Trend Sysclean utility and Adaware
7) Re-enable System Restore and re-apply any System Restore preferences,
(e.g. HD space to use suggested 400 ~ 600MB),
8) Reboot your PC.
9) Create a new Restore point


* * * Please report your results ! * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html




"Novice" <> wrote in message
news:0C34E147-BDFB-4CB6-8607-...
| Can someone please help?? I am running winxp and have a problem with
| intermittant crashing or disconnection from the net. When I connect a black
| screen pops up with the heading: 16 bit ms-dos Subsystem and then
| Locals~\temp\SurFairy~\.EXE When I press close it goes away. I have been told
| this is spyware. I run McAfee virus protection and MS firewall both are upto
| date. I have reinstalled windows to factory settings 5 times and still have
| the problem. I am such a novice and would appreciate and advice. Oh, and my
| modem drivers always need to be reinstalled when I start up the PC.

SORRY! as I said I am a novice.

"David H. Lipman" wrote:

> In the future, learn to post in the RIGHT News Group as what you ask has nothing to do with
> Windows Update !
>
> AUTOEXEC.NT Fix Method 1:
> copy; c:\windows\repair\autoexec.nt
> to
> c:\windows\system32
>
>
> AUTOEXEC.NT FIX Method 2:
> Go to; Start --> Run
> enter; cmd.exe
>
> { assuming the WinXP CDROM disk is in drive "D:" }
> In the Command Prompt enter...
> expand D:\i386\autoexec.nt_ %windir%\system32\autoexec.nt
>
>
> Since there are many forms of malware that can cause a problem with AUTOEXEC.NT, please
> perform the following...
>
>
> 1) Download the following three items...
>
> Trend Sysclean Package
> http://www.trendmicro.com/download/dcs.asp
>
> Latest Trend Pattern File.
> http://www.trendmicro.com/download/pattern.asp
>
> Adaware SE (free personal version v1.05)
> http://www.lavasoftusa.com/
>
> Create a directory.
> On drive "C:\"
> (e.g., "c:\New Folder")
> or the desktop
> (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
>
> Download Sysclean.com and place it in that directory.
> Download the Trend Pattern File by obtaining the ZIP file.
> For example; lpt394.zip
>
> Extract the contents of the ZIP file and place the contents in the same directory as
> sysclean.com.
>
> 2) Update Adaware with the latest definitions.
> 3) Disable System Restore
> http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
> 4) Reboot your PC into Safe Mode
> 5) Using both the Trend Sysclean utility and Adaware, perform a Full Scan of your
> platform and clean/delete any infectors/parasites found.
> (a few cycles may be needed)
> 6) Restart your PC and perform a "final" Full Scan of your platform using both the
> Trend Sysclean utility and Adaware
> 7) Re-enable System Restore and re-apply any System Restore preferences,
> (e.g. HD space to use suggested 400 ~ 600MB),
> 8) Reboot your PC.
> 9) Create a new Restore point
>
>
> * * * Please report your results ! * * *
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
>
>
>
>
> "Novice" <> wrote in message
> news:0C34E147-BDFB-4CB6-8607-...
> | Can someone please help?? I am running winxp and have a problem with
> | intermittant crashing or disconnection from the net. When I connect a black
> | screen pops up with the heading: 16 bit ms-dos Subsystem and then
> | Locals~\temp\SurFairy~\.EXE When I press close it goes away. I have been told
> | this is spyware. I run McAfee virus protection and MS firewall both are upto
> | date. I have reinstalled windows to factory settings 5 times and still have
> | the problem. I am such a novice and would appreciate and advice. Oh, and my
> | modem drivers always need to be reinstalled when I start up the PC.
>
>
>

"David H. Lipman",

This is the second time that I am asking you to refrain from responding
inappropriately to our customers. This is a public newsgroup for people to
come and ask questions about Microsoft products. If you are volunteering on
this website to come and help our customers--we appreciate it, and we thank
you. However, that does not mean we appreciate inappropriate -- and this
qualifies as intolerable.

In the future, when you find a poster that may have posted to the wrong
newsgroup, instead of saying:
> "In the future, learn to post in the RIGHT News Group as what you ask has
nothing to do with Windows Update !"

You could just as easily say:
"This does not appear to be a Windows Update issue. This newsgroup is
dedicated to questions and issues with Windows Update, a tool used by
Microsoft to update supported Microsoft Windows operating systems such as
Windows 98, ME, 2000, XP, and Server 2003. Your question would get more
help in the following newsgroups:

microsoft.public.windowsxp
microsoft.public.windowsxp.general

...."

For those of you that may not be aware, the help you receive on this website
is largely by volunteers who are dedicated to helping you, our customers.
Some of those individuals are inducted into the Microsoft Valued
Professional program (http://mvp.support.microsoft.com), which recognizes
outstanding volunteers for their technical knowledge and contribution to the
community through "the books and articles they author; the Web sites they
manage; the blogs they maintain; the user groups they participate in; the
chats they host or contribute to; the events and training sessions where
they present, as well as through the questions they answer in technical
newsgroups or message boards."

Sincerely,

Pat Walters [MSFT]


"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:#...
> In the future, learn to post in the RIGHT News Group as what you ask has
nothing to do with
> Windows Update !
>
> AUTOEXEC.NT Fix Method 1:
> copy; c:\windows\repair\autoexec.nt
> to
> c:\windows\system32
>
>
> AUTOEXEC.NT FIX Method 2:
> Go to; Start --> Run
> enter; cmd.exe
>
> { assuming the WinXP CDROM disk is in drive "D:" }
> In the Command Prompt enter...
> expand D:\i386\autoexec.nt_ %windir%\system32\autoexec.nt
>
>
> Since there are many forms of malware that can cause a problem with
AUTOEXEC.NT, please
> perform the following...
>
>
> 1) Download the following three items...
>
> Trend Sysclean Package
> http://www.trendmicro.com/download/dcs.asp
>
> Latest Trend Pattern File.
> http://www.trendmicro.com/download/pattern.asp
>
> Adaware SE (free personal version v1.05)
> http://www.lavasoftusa.com/
>
> Create a directory.
> On drive "C:\"
> (e.g., "c:\New Folder")
> or the desktop
> (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
>
> Download Sysclean.com and place it in that directory.
> Download the Trend Pattern File by obtaining the ZIP file.
> For example; lpt394.zip
>
> Extract the contents of the ZIP file and place the contents in the same
directory as
> sysclean.com.
>
> 2) Update Adaware with the latest definitions.
> 3) Disable System Restore
> http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
> 4) Reboot your PC into Safe Mode
> 5) Using both the Trend Sysclean utility and Adaware, perform a Full
Scan of your
> platform and clean/delete any infectors/parasites found.
> (a few cycles may be needed)
> 6) Restart your PC and perform a "final" Full Scan of your platform
using both the
> Trend Sysclean utility and Adaware
> 7) Re-enable System Restore and re-apply any System Restore
preferences,
> (e.g. HD space to use suggested 400 ~ 600MB),
> 8) Reboot your PC.
> 9) Create a new Restore point
>
>
> * * * Please report your results ! * * *
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
>
>
>
>
> "Novice" <> wrote in message
> news:0C34E147-BDFB-4CB6-8607-...
> | Can someone please help?? I am running winxp and have a problem with
> | intermittant crashing or disconnection from the net. When I connect a
black
> | screen pops up with the heading: 16 bit ms-dos Subsystem and then
> | Locals~\temp\SurFairy~\.EXE When I press close it goes away. I have been
told
> | this is spyware. I run McAfee virus protection and MS firewall both are
upto
> | date. I have reinstalled windows to factory settings 5 times and still
have
> | the problem. I am such a novice and would appreciate and advice. Oh, and
my
> | modem drivers always need to be reinstalled when I start up the PC.
>
>

Excuse me Mr. Walters but that was NOT an inappropriate response. Microsoft posters are no
different from posters posting anywhere on UseNet.

This News Group like all others are geared towards a specific set of problems. It is
inappropriate to ask a question that is Off Topic. Those who make the mistake SHOULD be
told that. As for the wording, I am not politically correct nor shall I be. And I did tone
down my rhetoric.

I told the person it was the wrong News Group to ask in then I supplied pertinent and
relevant information to assist the "novice".

BTW: If the OP thought it was a virus or worm then the following News Groups would be
apropos.

microsoft.public.scripting.virus.discussion
microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

--
Dave




"Pat Walters [MSFT]" <a-> wrote in message
news:4208056a$...
| "David H. Lipman",
|
| This is the second time that I am asking you to refrain from responding
| inappropriately to our customers. This is a public newsgroup for people to
| come and ask questions about Microsoft products. If you are volunteering on
| this website to come and help our customers--we appreciate it, and we thank
| you. However, that does not mean we appreciate inappropriate -- and this
| qualifies as intolerable.
|
| In the future, when you find a poster that may have posted to the wrong
| newsgroup, instead of saying:
| > "In the future, learn to post in the RIGHT News Group as what you ask has
| nothing to do with Windows Update !"
|
| You could just as easily say:
| "This does not appear to be a Windows Update issue. This newsgroup is
| dedicated to questions and issues with Windows Update, a tool used by
| Microsoft to update supported Microsoft Windows operating systems such as
| Windows 98, ME, 2000, XP, and Server 2003. Your question would get more
| help in the following newsgroups:
|
| microsoft.public.windowsxp
| microsoft.public.windowsxp.general
|
| ..."
|
| For those of you that may not be aware, the help you receive on this website
| is largely by volunteers who are dedicated to helping you, our customers.
| Some of those individuals are inducted into the Microsoft Valued
| Professional program (http://mvp.support.microsoft.com), which recognizes
| outstanding volunteers for their technical knowledge and contribution to the
| community through "the books and articles they author; the Web sites they
| manage; the blogs they maintain; the user groups they participate in; the
| chats they host or contribute to; the events and training sessions where
| they present, as well as through the questions they answer in technical
| newsgroups or message boards."
|
| Sincerely,
|
| Pat Walters [MSFT]
|

Thankyou for your support Pat Walters. I did not mean to cause such an
uproar. I will take my problem elsewhere and hope never to come across Mr
Lipman again.

"Pat Walters [MSFT]" wrote:

> "David H. Lipman",
>
> This is the second time that I am asking you to refrain from responding
> inappropriately to our customers. This is a public newsgroup for people to
> come and ask questions about Microsoft products. If you are volunteering on
> this website to come and help our customers--we appreciate it, and we thank
> you. However, that does not mean we appreciate inappropriate -- and this
> qualifies as intolerable.
>
> In the future, when you find a poster that may have posted to the wrong
> newsgroup, instead of saying:
> > "In the future, learn to post in the RIGHT News Group as what you ask has
> nothing to do with Windows Update !"
>
> You could just as easily say:
> "This does not appear to be a Windows Update issue. This newsgroup is
> dedicated to questions and issues with Windows Update, a tool used by
> Microsoft to update supported Microsoft Windows operating systems such as
> Windows 98, ME, 2000, XP, and Server 2003. Your question would get more
> help in the following newsgroups:
>
> microsoft.public.windowsxp
> microsoft.public.windowsxp.general
>
> ...."
>
> For those of you that may not be aware, the help you receive on this website
> is largely by volunteers who are dedicated to helping you, our customers.
> Some of those individuals are inducted into the Microsoft Valued
> Professional program (http://mvp.support.microsoft.com), which recognizes
> outstanding volunteers for their technical knowledge and contribution to the
> community through "the books and articles they author; the Web sites they
> manage; the blogs they maintain; the user groups they participate in; the
> chats they host or contribute to; the events and training sessions where
> they present, as well as through the questions they answer in technical
> newsgroups or message boards."
>
> Sincerely,
>
> Pat Walters [MSFT]
>
>
> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
> news:#...
> > In the future, learn to post in the RIGHT News Group as what you ask has
> nothing to do with
> > Windows Update !
> >
> > AUTOEXEC.NT Fix Method 1:
> > copy; c:\windows\repair\autoexec.nt
> > to
> > c:\windows\system32
> >
> >
> > AUTOEXEC.NT FIX Method 2:
> > Go to; Start --> Run
> > enter; cmd.exe
> >
> > { assuming the WinXP CDROM disk is in drive "D:" }
> > In the Command Prompt enter...
> > expand D:\i386\autoexec.nt_ %windir%\system32\autoexec.nt
> >
> >
> > Since there are many forms of malware that can cause a problem with
> AUTOEXEC.NT, please
> > perform the following...
> >
> >
> > 1) Download the following three items...
> >
> > Trend Sysclean Package
> > http://www.trendmicro.com/download/dcs.asp
> >
> > Latest Trend Pattern File.
> > http://www.trendmicro.com/download/pattern.asp
> >
> > Adaware SE (free personal version v1.05)
> > http://www.lavasoftusa.com/
> >
> > Create a directory.
> > On drive "C:\"
> > (e.g., "c:\New Folder")
> > or the desktop
> > (e.g., "C:\Documents and Settings\lipman\Desktop\New Folder")
> >
> > Download Sysclean.com and place it in that directory.
> > Download the Trend Pattern File by obtaining the ZIP file.
> > For example; lpt394.zip
> >
> > Extract the contents of the ZIP file and place the contents in the same
> directory as
> > sysclean.com.
> >
> > 2) Update Adaware with the latest definitions.
> > 3) Disable System Restore
> > http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm
> > 4) Reboot your PC into Safe Mode
> > 5) Using both the Trend Sysclean utility and Adaware, perform a Full
> Scan of your
> > platform and clean/delete any infectors/parasites found.
> > (a few cycles may be needed)
> > 6) Restart your PC and perform a "final" Full Scan of your platform
> using both the
> > Trend Sysclean utility and Adaware
> > 7) Re-enable System Restore and re-apply any System Restore
> preferences,
> > (e.g. HD space to use suggested 400 ~ 600MB),
> > 8) Reboot your PC.
> > 9) Create a new Restore point
> >
> >
> > * * * Please report your results ! * * *
> >
> > --
> > Dave
> > http://www.claymania.com/removal-trojan-adware.html
> >
> >
> >
> >
> > "Novice" <> wrote in message
> > news:0C34E147-BDFB-4CB6-8607-...
> > | Can someone please help?? I am running winxp and have a problem with
> > | intermittant crashing or disconnection from the net. When I connect a
> black
> > | screen pops up with the heading: 16 bit ms-dos Subsystem and then
> > | Locals~\temp\SurFairy~\.EXE When I press close it goes away. I have been
> told
> > | this is spyware. I run McAfee virus protection and MS firewall both are
> upto
> > | date. I have reinstalled windows to factory settings 5 times and still
> have
> > | the problem. I am such a novice and would appreciate and advice. Oh, and
> my
> > | modem drivers always need to be reinstalled when I start up the PC.
> >
> >
>
>
>

"David H. Lipman",

I think I was very clear in my posting. When you use "ALL CAPS", you are
shouting at the customer and it is not appreciated. You are answering a
posting, so it is assumed you are here to help, or you have the same issue.

Microsoft posters are, in fact, different than other newsgroup posters ...
to Microsoft. We take great pains to deliver great software and services to
our customers. All of these posters are our customers, and we want them to
have a great experience with our software--and with our newsgroup. I have
already stated in my last two postings to you that your behavior is
inappropriate. The last customer asked an innocent question related to our
software, and your tone was inappropriate.

To demonstrate my point, keep this in mind: those who post here could be as
young as a 5th or 6th grader that is having trouble with their Windows
Update. Would you really talk like that to a 9 or 10 year old child if
their parent were standing next to them? Of course not. You are invited to
help them if you can care for them in that way.

Sincerely,

Pat Walters [MSFT]


"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:#...
> Excuse me Mr. Walters but that was NOT an inappropriate response.
Microsoft posters are no
> different from posters posting anywhere on UseNet.
>
> This News Group like all others are geared towards a specific set of
problems. It is
> inappropriate to ask a question that is Off Topic. Those who make the
mistake SHOULD be
> told that. As for the wording, I am not politically correct nor shall I
be. And I did tone
> down my rhetoric.
>
> I told the person it was the wrong News Group to ask in then I supplied
pertinent and
> relevant information to assist the "novice".
>
> BTW: If the OP thought it was a virus or worm then the following News
Groups would be
> apropos.
>
> microsoft.public.scripting.virus.discussion
> microsoft.public.security.virus
> alt.comp.virus
> alt.comp.anti-virus
>
> --
> Dave
>
>
>
>
> "Pat Walters [MSFT]" <a-> wrote in message
> news:4208056a$...
> | "David H. Lipman",
> |
> | This is the second time that I am asking you to refrain from responding
> | inappropriately to our customers. This is a public newsgroup for people
to
> | come and ask questions about Microsoft products. If you are
volunteering on
> | this website to come and help our customers--we appreciate it, and we
thank
> | you. However, that does not mean we appreciate inappropriate -- and
this
> | qualifies as intolerable.
> |
> | In the future, when you find a poster that may have posted to the wrong
> | newsgroup, instead of saying:
> | > "In the future, learn to post in the RIGHT News Group as what you ask
has
> | nothing to do with Windows Update !"
> |
> | You could just as easily say:
> | "This does not appear to be a Windows Update issue. This newsgroup is
> | dedicated to questions and issues with Windows Update, a tool used by
> | Microsoft to update supported Microsoft Windows operating systems such
as
> | Windows 98, ME, 2000, XP, and Server 2003. Your question would get more
> | help in the following newsgroups:
> |
> | microsoft.public.windowsxp
> | microsoft.public.windowsxp.general
> |
> | ..."
> |
> | For those of you that may not be aware, the help you receive on this
website
> | is largely by volunteers who are dedicated to helping you, our
customers.
> | Some of those individuals are inducted into the Microsoft Valued
> | Professional program (http://mvp.support.microsoft.com), which
recognizes
> | outstanding volunteers for their technical knowledge and contribution to
the
> | community through "the books and articles they author; the Web sites
they
> | manage; the blogs they maintain; the user groups they participate in;
the
> | chats they host or contribute to; the events and training sessions where
> | they present, as well as through the questions they answer in technical
> | newsgroups or message boards."
> |
> | Sincerely,
> |
> | Pat Walters [MSFT]
> |
>
>

"ALL CAPS" -- Now that's funny !

--
Dave




"Pat Walters [MSFT]" <a-> wrote in message
news:42090e6e$...
| "David H. Lipman",
|
| I think I was very clear in my posting. When you use "ALL CAPS", you are
| shouting at the customer and it is not appreciated.

< snipped >