nokiacheck.exe......

[groucho]

..anybody heard of this? It makes my waiting egg-timer keep flashing on and off. I downloaded and ran process explorer as aranell so kindly advised and it says that it's a Windows Logon Service.
I highlighted nokiacheck.exe (which keeps flashing red within process explorer and the info for it keeps disappearing) and selected properties. In properties it says the path to it is C:/WINNT/sytem32/nokiacheck.exe (slashes round the wrong way due to PH)

I've searched in the directory and it is not there.

This definitely seems to be a strange one as google returns no hits.

BTW it runs in Task Manager but keeps disapperaring and re-appearing in synch with the egg-timer and is in the registry.

>> Edited by groucho on Saturday 27th August 12:35

[FunkyNige]

It's a worm -

Link

[groucho]

How do I get rid of it? Shall I just delete every entry in the registry as described by your link?

[FunkyNige]

groucho said:

How do I get rid of it? Shall I just delete every entry in the registry as described by your link?

Try using Microsoft's Malicious oftware removal tool -
www.microsoft.com/security/malwareremove/default.mspx
which should do the trick for you.

If that doesn't work, try HijackThis!
www.majorgeeks.com/download3155.html
but be very careful if you use that as you can delete imortant things using it!

[groucho]

I deleted every entry within the registry as shown by the link, re-booted and it was not in the Task Manager and it was not in the registry, so hopefully it's bogged off.

Cheeers FunkyNige.

[groucho]

I ran the tool from the top link and it said that it removed a Backdoor:Win32/Rbot.MA
Some kind of trojan by the looks of it.

>> Edited by groucho on Saturday 27th August 13:49