NLNP29.exp harassment

[crank33]

Help! Everytime I get online, the file NLNP29.exe tries to download. What is it? I downloaded it once and just left it on my desktop without activating it but each time I get online it wants to download again. My virus scanner says its OK, but what is it? DAP keeps asking me if I want to download it again. What is doing this? Thanks, Crank

[GaryRouth]

Hi Crank33

Nice to see you on the forum: but sorry it's for pesky software. My first guess is that you've been hit by spyware/adware, not by a virus. Probably wants to sell you something eventually, or (hopefully not) steal personal information. The only hit on Google for NLNP29 refers to an adult movie collection. Now, this may not be what is affecting your computer, but such sites can be very aggressive in trying to plant things in your system (without your permission). Might try a run of Ad-Aware just to see if that's it: http://www.lavasoft.de

Morriswingate recommends Search and Destroy for really nasty hijackers and invasive programs (the truly awful spyware). I don't have the exact link for that one, but it's on a download page over at http://www.spywareinfo.com

If you use Search & Destroy, I like to recommend making backups before you apply changes. And be ready to reinstall IE if necessary. Seems like a small tradeoff compared to the possible damage the spyware can do.

Best of luck
. . . Gary

[which]

Thanks Gary, nice to talk to you again. The last time you helped me, I was looking for a case for a new build. I took your advice, bought an Antec case, built a P4 system and its running beautifully. The download problem I mentioned above is on a Dell 8100 running Win 98SE.

When I hover over the file that I downloaded under protest, the balloon says its a program called WINSTART. If I execute it, it tries to access the internet again. Trashing it doesn't help because it immediately tries to download again. I'll go after it today.

I temporarily changed my name to "which" due to a spam problem I have but I'm still Crank.

Thanks for the help. See ya, Crank

[GaryRouth]

Hi again

Just in case it is a virus (there are some associated with WinStart - they alter a file called winstart.bat) you could try TrendMicro's online antivirus scanner HouseCall as a double-check to the antivirus already running on the Win98 machine. It's at http://www.trendmicro.com It takes a while to download on a dialup (could be a 30-40minute wait if in the 28.8k-33.6k range), and it takes a while to run, but would pretty much rule out a virus.

You can also look on the Win98 system to see if anything is in the tasklist that doesn't look familiar to you. (Ctrl-alt-del pressed only once brings up the list). You can also look in Start/Programs/Accessories/System Tools/System Information . . . and from the "Tools" menu select System Configuration Tool. Check under the Startup tab to see if what's in there looks OK to you. It's normal to have two PowerProfiles, the system tray, and perhaps RUNDLL for switching your screen colors and resolution with the little monitor icon in the system tray.

And hope the spam calms down. My father has been having spam trouble lately, too. The folks in Washington are considering legislation to make it illegal. That might be interesting. [And at least they finally passed the TeleMarketing "Opt Out" list - which I have high hopes for. I'm dead tired of telemarketer calls]

Best of luck
. . . Gary

[crank33]

Hello Gary,

Now I'm Crank again. "Which" is gone forever.

I tracked down the identity of my resident cockroach. It is a parasite called iGetNet. Read here

http://www.doxdesk.com/parasite/IGetNet.html

I did a system restore to over a week ago but it is still there so Its been lurking longer than I thought. In noticed a new entry in my Start Up file quite a while ago called WinStart but didn't think anything of it. Evidently, that was it. Now that I know what it is, I'll deal with it. The website I mentioned does say that neither Ad-Aware nor Spybot S&D will target this scumware as yet, so I turned it off in the Start Up list and will eventually figure a way to clean it out. Its not dangerous, just a pain in the you-know-where. Thanks for your interest. Advertising is getting too aggressive. Crank

[GaryRouth]

Hi Crank,

Just followed the link you posted. What a particularly nasty hijacker that one is. When they start editing host files, ARRRRGH.

Glad you found it (I'm going to guess you found it under a Winstart.exe search? I got a lot of hits for that one.) I imagine if it keeps up it's bad behavior, that the folks at AdAware will add it to their next reference list for removal.
. . . Gary

[crank33]

Gary, I was mistaken about one thing. Although Ad-Aware doesn't quite get it all, Spybot-Search and Destroy jerked it out by the nasty little roots. I thought I read than neither would get it but I didn't read correctly. Its gone now. Thanks.

Do you get Fred Langa's newsletter? He has an article this week about Ad-Aware. I just now received it. If you don't get it, I'll send the article to you or post it here. Crank

EDIT: OOOps, the LangaList is copyrighted.

[GaryRouth]

Hi Crank

I'd never heard of Fred Langa or the Langalist before, so I looked over at his homepage & read some back issues. Nice. Both fun and informative. I'll probably just wait a week and then see what he thought about AdAware (I'll guess that it was a positive impression).

I enjoyed his reminiscing about Win 3.0 and Win 95's early days. . . I can remember them myself: I bought Windows 2.0 for my father way back when. It was still running on my uncle's 386 (my dad gave it to him when he got his 486 [he has Ghz moblile Athlon in a laptop nowadays]) until late 2000, when I gave him a p233mmx box. . .

See you round the forum
. . . Gary

[catfishjoe_1]

Hey crank
Not sure but I think DAP is a spyware program, It has a lot a ads attached to it but you can get into the options and turn most of the crap off.
cat

[crank33]

Cat, you're right. I just read something about DAP lately but I can remember where I read it. DAP carries a lot of baggage but I do remember I decided it was not bad enough to get bent out of shape about it. I use DAP.

You might find this interesting---about Ad-aware and Turbo-Tax.

http://www.spywareinfo.com/newslette...2/12252002.php

[Jomama]

Dont hold your breath waiting for Ad Aware to update. They arent doing it anymore.
I recommend Search and Destroy. It is free and frequently updated.
http://security.kolla.de/