Home > General > Dees.exe


Back to top #6 Jacee Jacee Madam Admin Maude Admins 28,147 posts Gender:Female Posted 19 July 2005 - 02:03 PM Hummm, well it did appear as tho' it was gone Kill the process DEES.EXE and remove DEES.EXE from Windows startup. LATER]That was a waste.What if I (sigh) uninstall and reinstall those Spybot, MS AntiSpyware and SpywareBlaster? Click Yes to confirm.

thanks ronnie allan Remove Advertisements Sponsored Links TechSupportForum.com Advertisement 01-13-2005, 08:08 PM #2 CTSNKY TSF Team Emeritus, Security Team Join Date: Aug 2004 Posts: 10,821 OS: If you don't get the intro screen, just hit Scan and then click on Save log. 3. Search by Components dees.exe- Process Information This component is part of CWS.SearchX Component Name: dees.exe Description of : CWS Search X is a CWS variant that hijacks the user's browser and I got a message saying, "This folder contains 12 hidden files.

Tools button, and press Delete a file on reboot ... , select C:\Program Files\sder, press Open and Yes to confirm. to see if the above still applies. No 2.4GHz band connections on...

If those entries are back, post the new log. Share This Page Tweet Log in with Facebook Log in with Twitter Log in with Google Your name or email address: Do you already have an account? Learn More. Check the box to delete on reboot, then check the box to Use Dummy.

Its description was dees. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. I've caught this program 'dees.exe' trying to get online constantly. https://www.windowsbbs.com/threads/what-is-dees-exe.43919/ Dave Microsoft MVP - Internet Explorer 2006-2007-2008-2009 noahdfear, #19 2005/04/28 Bucksone Well-Known Member Thread Starter Joined: 2003/07/28 Messages: 489 Likes Received: 2 Trophy Points: 233 Location: Central Ohio, USA Computer Experience:

Logfile of HijackThis v1.99.1 Scan saved at 10:00:50 PM, on 4/27/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\system32\svchost.exe Use the arrow keys to highlight Safe Mode and press the key. Why not be the first to write a short comment? I chose to not delete them.

It may have already closed, or it may be protected by Windows. http://www.greatis.com/appdata/d/d/dees.exe.htm I just logged on as Owner and the icon was there. We may need to run some other tools. The message I got was "The selected process could not be killed.

But at a price. I couldn't find ru.exe. I'll reply in a couple hours. Computer Experience: [email protected]<*+ Similar to what Mark previously posted, copy the quote box to a blank notepad.

Back to top #16 Jacee Jacee Madam Admin Maude Admins 28,147 posts Gender:Female Posted 21 July 2005 - 01:29 PM So while using FF, and clicking on http://www.toast.net/start, did you Computer Experience: [email protected]<*+ My mistake.....sorry After entering the filepath in Killbox, check the box to replace on reboot, then use dummy, then click the red X and allow reboot. Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15009/CTSUEng.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Back to top #2 Jacee Jacee Madam Admin Maude Admins 28,147 posts Gender:Female Posted 13 July 2005 - 06:14 PM Hi tkasle Open HijackThis, press the Config...

I see I could check the box to remember that decision, but I haven't checked that because I feel I might just be ignoring a problem. I'm going to bed. MessengeriTunesWindows Media PlayerSkypeWinRARWinAMPMicrosoft WordMozillaAdobe PhotoshopMozilla FirefoxMusic MatchMicrosoft OutlookGoogle ToolbarMacromedia FlashSanDisk CruzerLockCompreXX LightComodo TrustToolbarKawaksAbleGetMicrosoft Windows LiveTeamTalkMicrosoft Windows DefenderMWSnapHTB Instant MessengerHP PhotosmartPersonalWebMotive (BroadJump) Communications SoftwareSoftsun Net AssistantSmartLink Device DriversSpyStopperSUPERAntiSpywareReal JukeBoxUltraPlayer Media PlayerIECleanActive Email

Two restarts later (what a pain this is), no more "sder", no more "dees.exe." BUT........I've used Netscape for 1-1/2 years (since IE started attracting more crap than flies to honey).

There's a "make this my homepage" link to click on the "www.toast.net/start" page. Score User Comments There are no user opinions yet. Here's my latest HJT Log: Logfile of HijackThis v1.99.1 Scan saved at 2:04:06 PM, on 7/19/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe Bucksone, #18 2005/04/28 noahdfear Inactive Joined: 2003/04/06 Messages: 12,178 Likes Received: 15 Trophy Points: 608 Location: New Bremen, Ohio U.S.A.

I went into Windows Explorer, followed that path, but couldn't find it. Yes, my password is: Forgot your password? This is the 'canned speech that everyone gets when they're clean Great job! Cookies Registration Notice What is dees.exe Discussion in 'Malware and Virus Removal Archive' started by Bucksone, 2005/04/20.

I used Killbox and followed the directions, but it's still trying to access the Internet when I reboot. Click Open Process Manager and see if dees.exe and ru.exe are present and can be killed. keyboard or browser monitoring, autostart entry). EWIDO found it twice and cleaned it twice.

Reboot your computer. They could click using 3 different browsers. Sometimes it's the obvious that eludes me. But I did answer Yes to the last three items, then rebooted and ran CleanUp, which deletes all Temp files, thereby answering Yes to the the first two items (I assume).

I've tried in the past to get rid of that crazywinnings thing with no luck. I've always denied it, I'm wondering what this is and is it spyware or something? To use the Dummy file, select Replace on Reboot, you'll find it is not greyed out. Yes, yes, and yes.

Run HijackThis Analyzer and type in y if you agree. Username Forum Password I've forgotten my password Remember me This is not recommended for shared computers Sign in anonymously Don't add me to the active users list Privacy Policy EntfernenWir verwenden MS - MVP Consumer Security 2006 thru 2016 Back to top #17 tkasle tkasle Member Members 28 posts Posted 21 July 2005 - 02:30 PM So while using FF, and clicking Click Start>run and type %temp%, hit enter.

Its type of file was application. Computer Experience: [email protected]<*+ You're probably logging onto the Admin account in safe mode rather than yours. Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx O16 - DPF: {7142BA01-8BDF-11CF-9E23-0000E8A37440} (Surround Video Control Object) - http://admission.udayton.edu//VirTour/svideo.cab O16 The "sder" file again appeared in Programs when I cranked up this AM.

That should remove the trusted zone entries. Double click on the program to run it. 1. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Move the bat file to C:.........you'll know right where it is regardless of what account you're on.