OBE32.exe; OBEMAIL.exe, OBEE.exe, OBEServ.exe

OBE32.exe; OBEMAIL.exe, OBEE.exe, OBEServ.exe

Post by UnVzc2Vsb » Wed, 24 Aug 2005 19:25:10


I've been plagued by these three processes running on my PC. I can't kill the
processes, and they slow down my PC terrribly. Also, all processes are
"recognised" as Microsoft Corp. apps. All these files are 172 kb. and cant be
found when booting from booting from a disk. A Google search reveals no
solutions... only that other people have a problem with these. Does anyone
know what these files are, where do they come from, what do they do, are they
Microsfot products, and how do I get rid of them or stop them running? A
virus search does not identify these files as viruses, worms or trojans. Can
anyone help please!!
 
 
 

OBE32.exe; OBEMAIL.exe, OBEE.exe, OBEServ.exe

Post by Don Philli » Wed, 24 Aug 2005 20:27:18


the
be

Whatever the cause, you can prevent these running
by (in DOS if necessary) renaming the EXE files as
type XXX and rebooting. Your startup files may then
generate error messages (EXE file not found) that
help you trace the cause: but files that do not load
at all cannot slow down your PC.

--
Don Phillipson
Carlsbad Springs
(Ottawa, Canada)

 
 
 

OBE32.exe; OBEMAIL.exe, OBEE.exe, OBEServ.exe

Post by Ron Badou » Wed, 24 Aug 2005 21:41:55

Those .exe files are not listed in the MS Knowledge Base and therefore are
not MS related files. It appears these files are being started at boot and
if so, you will not be able to rename or delete them. Check Add/Remove
Programs in the Control Panel to see if there is some sort of a program
installed that might use these files. If so, uninstall it. If not, go to
Run on the Start button, type: msconfig and hit OK. Click the
startup tab, find and disable (remove the mark) the references to these
files. Restart the computer. Be sure that all files are being shown
(Windows Explorer, click view, click folder options, click the view tab and
mark Show All Files), do a find on the files and rename them. Reboot to see
if the files have been replaced by some other program being started at boot.
If they have not, then you should get a notice or notices stating that the
files cannot be found. All that remains will be to find the references to
the files in startup points and delete them. These are the typical start up
points:

Start up folder on the start menu, the load= and run= lines in the win.ini
and these registry run keys (use regedit.exe):

1. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRun
2. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\un
3. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRunOnce
4. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\unOnce
5. HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRunServices
6.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRunServicesOnce
7.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRunOnce\Setup

Note: There could be a minus sign at the end of the key: i.e.,
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersionRun-


--
Regards


Ron Badour, MS MVP for W98
Tips: http://www.yqcomputer.com/
Knowledge Base Info:
http://www.yqcomputer.com/
 
 
 

OBE32.exe; OBEMAIL.exe, OBEE.exe, OBEServ.exe

Post by PA Bea » Thu, 25 Aug 2005 05:16:35

cf. http://www.yqcomputer.com/

None of them are valid Windows files.

Checking for/Help with Hijackware
http://www.yqcomputer.com/
http://www.yqcomputer.com/
http://www.yqcomputer.com/
http://www.yqcomputer.com/
http://www.yqcomputer.com/
http://www.yqcomputer.com/
http://www.yqcomputer.com/
http://www.yqcomputer.com/

When all else fails, HijackThis v1.99.1
( http://www.yqcomputer.com/ ) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://www.yqcomputer.com/ ,
http://www.yqcomputer.com/ ://aumha.net/viewforum.php?f=30
for expert analysis, not here.**

--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE/OE, Shell/User, Security), AH-VSOP