A few days ago a file named efes.exe showed up on my comp, in the All Users\Start Menu\Programs\Startup folder under Documents & Settings, which I have no idea of its purpose or danger. It also seemed to show up on my bro's comp the same day.

this list would have been helpful if it actually listed it http://www.pacs-portal.co.uk/startup_pag...p_full.htm

No idea i am afriad but if you know how to use a hex editor you could try find out what the header of the file is. Or you could send it to me and i could have a look.

try to rightclick -> properties on the shortcut and see what it wants to activate, if it looks suspicious try to run a anti-spyware program or virus scanner, or try to disable it (if it messes up you might need it)

i would say that its either a program that autoruns from a recently installed program, a spyware, trojan, or whatever

cant be too safe, couple of months ago i had a suspicous file that i couldnt delete cause it kept autorunning, though it was not on the startup(nor registry), it also took off my access to the C: (running 2k as admin) so i couldnt use my firewall/virus scanner, i ended up having to reenable my access (editing properties) and deleting the file manually through safe mode

programs i would recommend is:
WinTasks 4 http://www.liutilities.com/
or any other program that lets you edit your startup/complete control of your comp

Wow! Now this is strange....

Just two days ago, the company I work for had the same thing on one of the workstations. (I'm the sys admin)

The file was on a 98se machine in the startup folder and was hidden. I couldn't delete it under windows so I booted with a DOS floppy and killed that way.

I spent the better half of the day searching the Internet for any reference to this but came up empty handed.

ECO, is your computer doing anything strange? How I noticed something was wrong was when I was doing some routine maintenance and noticed a 3-4 second pause when I was typing or just clicking on files and folders. After I killed the file, eveything cleared up.

Please post back if you get any more info on this.

I just killed real player good! I wanted to set media player classic ( not windows version but a 3rd party version that handles real media and quicktime if those programs are installed) as the default for .ram, .rm, and .mov files. Real media player has a setup program in the install. That went. Then the actual .exe and realjukebox.exe, and deleted all the real player entries in registry and deleted the .ram and .ra extensions. Then reassociated with a right-click and properties.

I use jv power tools for startup programs and cleaning up the registry (finds useless keys). I use spybot search and destroy and adaware.

I need control of my computer!

Web based virus scanner (free - recommended by my isp):

http://www.bitdefender.com/scan/licence.php

ah i too have that media player classic thing and was looking for a way to get it to play the real media files (since i didnt want to install real media player cause of all its faff). Was looking just for the codecs but guess i cant have them lol

Hmm the WORD EFES in hebrew is ZERO in English
it's Hebrew Slang to call some 1 EFES(ZERO)
so i guess it's some kind of trojen

I found out that it's a polymorphic virus named W32.BugBear.B@mm !!

It is fairly serious because it allows the virus author to control your PC, start or stop process, etc. etc. and it's also a keylogger which sends off all of your typings to one of many predefined email addressed every 2 hours, creating a serious security breach. It is treatable since the June 5th, 2003 Norton Anti-Virus update.

Yes and a good way to get rid of it is to type: Format C: in DOS prompt.

a bit drastic, but VERY effective :wink:

Humm, I'll I typed was "delete efes.exe".