Re: VSS_PS.EXE

From: Wesley Vogel (123WVogel955_at_comcast.net)
Date: 06/15/04 

Date: Tue, 15 Jun 2004 02:55:49 GMT

Gerry,

Changing the name was a good idea. Does it still try to access the
internet? Does it still try to start at boot? Any error messages?
Are you hungry? Just kidding. :-)

206.58.237.248 has something to do with this site.

http://www.verio.net/

Mean anything to you?

I am very leery when an exe file has no version tab. Reeks of scumware.
Monitor it for a while and then delete VSS_PS.EXE.
If it is legit, which I doubt and you need it, you can always reinstall
whatever it was part of.

C:\windows\prefetch\VSS_PS.EXE-O6AD80C2.PF is just a file to
make VSS_PS.EXE load faster.

I would get some scumware ammo (below) if you don't have any of these
programs.

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

>>>>>>> Run CWShredder first!!! <<<<<<<<<<<<

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp 

-- 
Hope this helps.  Let us know.
Wes
In news:ulBzLamUEHA.4064@TK2MSFTNGP11.phx.gbl,
GEB <gerryboulter@hotmail.com>  hunted and pecked:
> I'm running XP Home edition. Here's what I've found.
>
> 2 versions of VSS_PS.DLL - one in the C:\windows\system32 folder and
> the other in the C:\windows\system32\dllcache.
>
> I found the VSS_PS.EXE file in the C:\windows\system32 folder. I also
> found a file named VSS_PS.EXE-O6AD80C2.PF in the C:\windows\prefetch
> folder.
>
> I ran sfc /scannow but didn't receive any messages when the program
> finished, so I assume all was OK.
>
> The properties for the VSS_PS.EXE file shows three tabs General,
> Compatability and Summary. The particulars under the General tab are
> as I mentioned in my initial posting:
> created on Friday, August 17, 2001, 9:02:03 PM and is 51.3 KB (52,625
> bytes) in size.
> Compatability shows nothing checked.
> Summary no details shown re the author, version number etc.
>
> When this program tries to access the internet ZoneAlarm indicates
> that the Destination IP is 206.58.237.248. This IP address appears to
> be nothing but a blank page with a grey background.
>
> I have since renamed the file to VSS_PS.XXX and have not run into any
> problems with any of the programs I normally use.
>
> A mystery to say the least.
>
> Gerry
>
>
>
>
> "GEB" <gerryboulter@hotmail.com> wrote in message
> news:OtAb4tYUEHA.760@TK2MSFTNGP12.phx.gbl...
>> The file is in the C:\windows\system32 folder as is vss_ps.dll. I am
>> thinking that I might rename the file extension to .xxx to see what
>> if anything happens to any of the programs.
>>
>> Gerry
>>
>> "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
>> news:Cj%yc.14489$Hg2.7249@attbi_s04...
>>> Gerry.
>>>
>>> What folder are you referring to??  This might be a clue.
>>> Scratch that.  c:\windows\system right??
>>>
>>> I am running XP Pro.  vss_ps.dll is in these two folders:
>>> C:\WINDOWS\system32
>>> and
>>> C:\WINDOWS\system32\dllcache
>>>
>>> vss_ps.dll
>>> Size:  16.5 KB (16,896 bytes)
>>> Size on disk:  20.0 KB (20,480 bytes)
>>> File version:  5.1.2600.0
>>> Description:  Microsoft® Volume Shadow Copy Service proxy/stub
>>>
>>> How many copies of vss_ps.dll do you have??
>>> In what folders??
>>>
>>> Right click VSS_PS.EXE | Properties | Look under all tabs |
>>> Especially the version tab | General tab > Opens with??
>>>
>>> VSS_PS.EXE or VSS_PS.EX_ does not exist on either the XP Pro or
>>> Home CD, I checked both.
>>>
>>> Returns: [[No matches found. Either the database does not contain
>>> this file, or your search term was not appropriately entered. ]] @
>>> DLL Help Database
>>>
>>
>
http://support.microsoft.com/default.aspx?scid=/servicedesks/fileversion/dllinfo.asp
>>>
>>> [[Your search - VSS_PS.EXE - did not match any documents.]] @
>>> www.google.com
>>>
>>>
>>> Start | Run | Type:   sfc /scannow    |OK
>>> Have your XP CD ready to stick in your CD drive.
>>>
>>> scannow sfc (sfc.exe)
>>> http://www.updatexp.com/scannow-sfc.html
>>>
>>> --
>>> Hope this helps.  Let us know.
>>> Wes
>>>
>>> In news:hWZyc.9324$_V4.2116@read1.cgocable.net,
>>> Heeby Jeeby <dianneboulter@home.com>  hunted and pecked:
>>>> The file is VSS_PS.EXE. The file Vss_PS.DLL is also in the folder.
>>>> I've run Noron AV and it doesn't detect the file as a virus. Also
>>>> ran Ad-awre and SpyBot. Again nothing.
>>>>
>>>> Any further thoughts?
>>>>
>>>> Gerry
>>>>
>>>> "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
>>>> news:YaFyc.74302$3x.21376@attbi_s54...
>>>>> vss_ps.dll is an XP file = Microsoft® Volume Shadow Copy Service
>>>>> proxy/stub
>>>>>
>>>>> vss_ps.exe does not appear to be an XP file.
>>>>>
>>>>> Check your spelling or update you anti virus software and run a
>>>>> complete scan.
>>>>>
>>>>> --
>>>>> Hope this helps.  Let us know.
>>>>> Wes
>>>>>
>>>>> In news:eIzWdZHUEHA.3976@TK2MSFTNGP09.phx.gbl,
>>>>> GEB <gerryboulter@hotmail.com>  hunted and pecked:
>>>>>> Recently I've noticed that the file VSS_PS.EXE is starting on
>>>>>> boot up. In addition, my firewall asks whether I want the file
>>>>>> to access the internet (so far I've have not granted it
>>>>>> permission). The file is located in my c:\windows\system folder.
>>>>>> The file was apparently created on Friday, August 17, 2001,
>>>>>> 9:02:03 PM and is 51.3 KB (52,625 bytes) in size.
>>>>>>
>>>>>> If this a legitimate windows file. Does it need to access the
>>>>>> internet and if so for what purpose?
>>>>>>
>>>>>> Thanks

Relevant Pages

  • Re: Internet Explorer Favorites
    ... >i cant find them in the folder, ... AdAware, CWShredder, and Spybot S&D have install routines - run them. ... Spyware Warrior: ... Block possibly dangerous websites with a Hosts file. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Links in Outlook Express e-mails take me to random folders
    ... To ininstall a beta version of Internet Explorer 7 and return to Internet ... Uninstalling IE7 Beta2: ... Panel> Folder Options. ... or format your PC and install Windows anew. ...
    (microsoft.public.windowsxp.general)
  • Re: Not able to see ipaddress or renew or release it.
    ... AdAware, CWShredder, and Spybot S&D have install routines - run them. ... Next, close all Internet Explorer and Outlook windows, and run CWShredder. ... Spyware Info: ... Block possibly dangerous websites with a Hosts file. ...
    (microsoft.public.windowsxp.network_web)
  • Re: cant personalise my desktop
    ... Open ONE copy of Internet Explorer. ... Install the first five of these: ... Bazooka Adware and Spyware Scanner ... Browser Security Tests (Free Tester) ...
    (microsoft.public.windowsxp.general)
  • Re: web dialer
    ... AdAware and Spybot S&D have install routines - run them. ... Next, close all Internet Explorer and Outlook windows, and run CWShredder. ... First update it ("Check for updates now"), ... Spyware Warrior: ...
    (microsoft.public.windowsxp.network_web)