Re: What does cdomeui.exe.file do?

From: Rick \ (rick_at_mvps.org)
Date: 07/25/04


Date: Sun, 25 Jul 2004 15:21:24 -0400

Hi Ray,

It's a trojan (virus) file. You don't want it accessing the internet
(phoning home) or even on your system. Follow these "relatively" simple
removal steps:

Restart in Safe mode by hitting F8 as Windows first begins to load on boot.
Logon as administrator.

Start/search/files and folders, look for <filename> and delete it wherever
it is found.

Start/run regedit, expand the + signs to look under these keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

Look in the right hand pane for the string or strings that load that file.
Delete just those strings that contain the reference. Do not delete other
strings or the keys from the left pane. Close the registry editor when
completed, make sure you check all strings.

Go to the Control Panel/System/System Restore tab. Check the box to "Turn
off system restore on all drives". Click apply/ok. This will remove all
restore points, however you don't want them back as some or all of them will
contain the virus depending upon how recently you got infected.

Restart the system normally. Go back to the Control Panel/System and restart
System Restore.

Update your antivirus software.

-- 
Best of Luck,
Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org
"Raymond Sanborn" <anonymous@discussions.microsoft.com> wrote in message
news:3b4b01c4727b$5a1891c0$a301280a@phx.gbl...
> My Firewall keeps asking me if I want to allow the file
> cdomeui.exe to access the Internet. I recently had a bad
> experience with Adware and Spyware and finally got my
> computer cleaned up. I'm afraid to allow access to files
> I canot identify, of which this is one, so I don't allow
> it to access the Internet.
> However, periodically I get this same request. I can't
> see any detrimental effect on the operation of my
> computer by denying access of this file. However, I still
> wonder what the heck it is? Does anyone know?
> Ray


Relevant Pages

  • Re: LIBVGA.EXE???
    ... Restart in Safe mode by hitting F8 as Windows first begins to load on boot. ... Look in the right hand pane for the string or strings that load that file. ... off system restore on all drives". ...
    (microsoft.public.windowsxp.general)
  • Re: cpu at the races
    ... Restart in Safe mode by hitting F8 as Windows first begins to load on boot. ... Look in the right hand pane for the string or strings that load that file. ... off system restore on all drives". ...
    (microsoft.public.windowsxp.general)
  • Re: adminamok
    ... Restart in Safe mode by hitting F8 as Windows first begins to load on boot. ... Look in the right hand pane for the string or strings that load that file. ... off system restore on all drives". ...
    (microsoft.public.windowsxp.newusers)
  • Re: Error message at startup
    ... Restart in Safe mode by hitting F8 as Windows first begins to load on boot. ... Look in the right hand pane for the string or strings that load that file. ... off system restore on all drives". ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: winlogG.exe, winlogO.exe, winlogY.exe, winlogB, winlog.exe
    ... They are trojan (virus) files. ... Restart in Safe mode by hitting F8 as Windows first begins to load on boot. ... Look in the right hand pane for the string or strings that load that file. ... off system restore on all drives". ...
    (microsoft.public.windowsxp.help_and_support)