Please see my comments under "Response Number 12" at the following URL: http://www.computing.net/security/wwwboard/forum/11720.html Please let us all know if this (or whatever) fixes the problem.

0

Erin, Try Response Number 9 at http://www.computing.net/security/wwwboard/forum/11722.html

0

The actulice problem Amber described happened to me yesterday and plagued me all of today. I followed Yadirf's instructions in Response 12 and have been actulice free ever since. Thank you for the advice!

0

I have followed some of the advice you suggested and cannot find the file in msconfig, is there something else that I can do about this actulice pop-up?

0

Hi I have this pop up problem as well and I am trying your suggestions now but i was wondering...... what exactly does this thing do. I mean is it just a pop up or is it doing something else. PS: Im running XP is there any change in wut i should do?

0

Hi I have this problem too running windows xp. After checking my startup tab as suggested through several boot iterations I found I was getting one startup that constantly changed names. I finally tracked it down as aveej.exe, it was located in my windows32 folder. After Ctrl-Alt-Del and stopping the aveej process I was able to delete this file. This seems to have fixed my pop-up problem but I still have the file aveej.exe in my startup tab. Anyone know how to get rid of this? Anyway, my solution was to look for the mutating startup program. Just write'em all down and see which new one pops up, then KILL it. Matt

0

I tried everything that all of you had suggested but to no avail. Finally I did a search of the .exe files in my windows folder. I knew about which date the actulice pop-up started so I checked all .exe files that had a corresponding modification date. I found the culprit. For me it was SOCK2W.exe., located in my Windows system file. I was unable to simply delete the file because a window pops up that says Windows is using the program, however, if you go to your start menu, click on "run" and type in "msconfig" go to "startup" and scroll down until you find the culprit file (for me SOCK2W.exe) Uncheck it and then restart your computer. After the computer has rebooted you can delete the file. don't forget to empty your trash bin after you have deleted the file. THEN, you can smile!

0

One correction about the comprehensive fix for remvoing actulice popups and other malware program files manually posted on http://computing.net/security/wwwboard/forum/11720.html http://computing.net/security/wwwboard/forum/11722.html http://computing.net/windows95/wwwboard/forum/158218.html http://computing.net/security/wwwboard/forum/11772.html The free Sysclean engine and the matching virus definition sofware were downloaded from TrendMicro.com and not from microtrend.com as I stated. I can't believe there is also a microtrend website. In case anyone wants a free antivirus program, I got the free virus scan from Trendmicro through www.housecall.antivirus.com to do the online scan first. I download and update the sysclean engine and the matching virus definition files as they become available. Top Speed

0

just to say that in my computer, actulice pop-up name is not pg4ds32m but xapid.exe!!! I hope it will serve to somebody!

0

I have tried all of the suggestions you all have made! None of them have worked for me.I have looked all the names up under the startup tab and none of them end in .exe! I am not sure what to do!!!!!!!!! Someone please help me if you can! ali

0

i used system restore a few days ago... And that worked , but only for a short amount of time ali

0

I ctrl-alt-deleted and went to show process, i found it was a program called atimed.exe, so i ran a search for it and found it located in //windows/system32 folder. It also found a file containing 'atimed' in "//windows/prefetch" folder. This actuilice modf business wouldnt go away with spy sweeper and other programs but ive deleted it and it hasnt come back since. I hope this helps. -zack

0

Yet, another variation - this one was called dbcinsto.exe in \windows\system. I found that after having disabled this in MSCONFIG (Win98SE BTW), I then Clicked on Actulice and responded OK to both "OK" prompts. After doing so, I noticed a DUPLICATE of the DBCINSTO.exe option that WAS CHECKED OFF!! Nasty...

0

I had the actulice popup for several days and couldn't get rid of it. I followed Matt's suggestion (#12) and wrote down the startup names on the startup tab. I rebooted, and sure enough, one of the names had changed. I unchecked that one, rebooted again and then deleted that name. Seems to be OK so far. Earlier, a virus scan had detected six files related to this, including pup.exe, S32GTD.exe, and twaintec.dll.

0

You are all HERO's! decided to go to my dads today cos i havent been for ages. Found out he'd spent all day trying to get rid of sum other virus, so i got a "DONT KNACK THE PC!" when i went on. He went out and 10 minutes later.... "ping" actulice, No modF. Just managed to sort before he got back! I still have the file (XTRANSD) in the start up tho, how do i get rid of it?

0

Well, I just noticed "my" Aculice problem last night. After reading the posts I THINK I have it fixed. I'm running XP... So I ran a search for the pup.exe file and I found it. Before I deleated it I checked the time and date of it's creation (03-16-04!) Next, I ran a search for all files created on that date and time (there were 7!) I was able to delete all but one (msinet.ocx). So then I went to the system start up tab in msconfig, disabled it, deleted it and BINGO! Good stuff. It looks like the problem file hides in the C://windows/system32 file. That may help to narrow down which process it is calling itself on the start up tab. I found it on the second try. Please take this all with a grain of salt. I really don't know much of anything when it comes to computers. I just followed the advice I found here and made my own observations. I hope I didn't screw something else up! Now my big question. HOW DO I GET THE THING OFF MY START UP TAB!!!! Oh PS, It was labeled "ASSDOI" on my start up tab! Thanks to all for the advice and good luck!

0

Just to add to the fun... Helped a friend clean off this actulice thing. On her machine (W98SE) the culprit was called WCIM.exe in \windows\system. It was in the startup list (MSCONFIG) but didn't change its name. The easiest way to find it is to run MSCONFIG, select Selective Start UP, go to the Start Up tab and uncheck anything you don't recognize (unless, of course, you see one of the names in this thread of messages, then start by unchecking just that). Then click Apply and re-boot. If Actulice doesn't come up, go back to MSCONFIG and turn half the things you unchecked back on and re-boot. Repeat this until you isolate the culprit. Find the program it runs and delete it. Then run REGEDIT. Expand the directories to get to My Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion There will be a key called Run and another called Run-. Click on Run- and the culprit should be there all by itself. Delete the whole Run- key. Exit REGEDIT, re-boot, and you should be clean. Good Luck.

0

I Have windows XP- May 19, 2004 at 7:40 I think i have a simple solution to your problem! Thanks to Jack Go to windows>system32, let your pc search for all "exe" files. (also the hidden files) When the search engine is ready, you select the list of files, on volume (Kb's). You only have to be interested in files with 64kb. The files may have differend names but if you watch in "properties" you will see if its a "totempole" "werule" "thunderdome" file. ( could be more names out their too ) First i was not able to delete the exe files because they were active at the moment. This problem can be solved if you shut down your pc and restart it in "save mode" Now you just repeat the same things and you will see that it is possible to eliminate the "exe" files. If you wan't to be sure that all the files are eliminated, you also need to run a search on "program files"! Good luck

0

i just got rid of it too. i dont think this is a virus, its just a simple lil stupid program some stupid person wrote. Anyways - go to "my computer" and into "c drive" into your "windows folder" then into "system 32" look for an rectangle icon with a light blue top, it should look exactly like the one on the actulice pop-up. now you know the name of it !! press "crtl", "alt" and "del" and disable that program then delete it from your system32 folder EASY~ good luck to the rest of you.

0

um.. i did what all you guys suggested and i DID find the files that you told me to delete but um whenever i start up the computer, i still have the actulice popup that says "modup" .. i have a windows xp .. is there anything you guys can do? :P

0

I found the worm in windows startup as TSENUXXA (run msconfig click startup and uncheck the box), when i first did this and didnt delete it it reappeared under another name but it always seems to end with exe so I suggest you check all files in startup ending in exe particularly those that dont seem to relate to anything on your computer and gradually uncheck them one at a time rebooting each time untill the problem disappears dont worry there arent many that end in exe when you have located the culprit do a file check to find it delete it and also empty the trash bin good luck!

0

I just started this joyous expedition yesterday! I got this even though I HAVE Norton Antivirus with latest definitions! I installed webroots spyware software and it found hundreds of those adware pop up things but it couldn't find actulice. I even had a £1.50 a minute conversation with a guy from Symantec who was just argumentative and unhelpful - its not even on thier radar. What a disappointment - looks like we are alone and these companies probably sponsor people to write this stuff to make themselves rich while we have all this enjoyment! Lets see how long it take me to get rifd of this thing.

0

I ran into this problem myself and i downloaded ad-aware and ran it and it took care of the problem. Its a free for download at www.download.com.

0

Just a reminder, after you install and open up ad-aware, make sure that you update it before you run it.

0

Thank-you Yadrif! The process of elimination worked!! I unchecked half the processes in msconfig startup tab. Didn't get the pop-up on reboot so I knew it was one of those. I rechecked half of them trying to select ones I suspected to be valid... still no pop-up. Repeat until I got down to the last 4 then just guessed until it came up again. Upon reboot the task in that slot was renamed to AVAPERMJ.exe int windows/system. Sorry guys, I forgot what it was named before - but it was NOT that. ANyway, disabled it, deleted it, and I have been pop-up free for 20 minutes.. yeah! Thank-you all for your ideas and help!

0

One more for the pop-up. What a pain. Run MSCONFIG and in the startup find a file running that is not required to the best of your knowledge. It changes it's name all the time. It's a .exe in Windows\system32. Remove the check mark from that file and select Apply. You will need to reboot. Then go to \windows\system32 find that file and delete it. Reboot. Then run MSCONFIG and in the General tab reselect to load all drivers at startup, reboot. Took care of my pop-up, finally...... pcannie

0

Don't forget to delete from recycle bin. pcannie

0

Obviously this worm is a bit tricky. In addition to installing a lot of crap on your computer, it overwrites windows media player and reinstalls it self everytime you try to use it (wmplayer.exe). The problem is complicated even further by the fact that MS has made it so difficult to uninstall this application. Here is what worked for me 1) Close all the pop-up windows and clear temporary files 2) Run you updated ad-aware and remove alle the junk that it findes 3) Run HiJackThis and disable any remaining entries related (look for pup, msbb, 180Solutions) 4) Open your windows folder and delete actulice.exe and bdl14026 5) Open your system32 folder and delete any additional instances of bdl14026 6) Go to programs/windows media player/ and delete all files 7) Reinstall windows media player 8) Reboot in safe mode and run your updated AVG 9) Reboot again Now you should be safe Just another webaddicted dude

0

I tried to delete the files in Windows media player but it wont work. Every time i delete them they come back!

0

I could have just saved you if u have xp. Simply, if you rememb wen u downloaded it, just go all programmes>accecories>system tools>system restore. Now just restore the computer to a date before you had this actulice thing, and it should be gone. Was for me. Now.........Smile

0

I was so glad to find this thread. I searched for anything about actulice about a week and a half ago and found nothing! Well, following the advice I have read in the previous responses- so far so good NO actulice pop-up. I am trying to remove it from the registry editor as suggested in response 23 but cant find the right thing to rid. Any help? The file was sutbm.exe, by the way.

0

I got the actulice thing yesterday. Searched system32 for files modified on the day i got it as suggested. This revealed a .exe file that was on my startup list named 'x7vbd.exe' that was created by a company (read arsehole) named thunderdome, hope that helps. Deleted it and all is well, still get the name in the startup list but at least i dont get a bloody message ordering me to funk everytime i start up. Its not my kind of music ;)

0

Hey Kiwi377 Thanks for the suggestion - adaware 6 solution is looking good (fingers crossed) ais

0

Thank you, Anssi!! I do have XP and your solution worked - at least I haven't had the pop-up for over 45 min.! Let's hope it lasts.

0

The new name it has come up wih is CWPHBKI

0

Hmm...I also got actulice but i also found some strange stuff that was created the second actulice got onto the comp. A bunch of tmp files starting with GLCA2.tmp ending with GLCF4.tmp. They all were created within 3 seconds of actulice and im not sure whether they are related to it or not...

0

I was having the same annoying problem as everyone else with Actulice, No ModF, Funk, etc. I am running Windows 2000 and the following removal worked for me. STEP 1 follow KOYUREI's Responce No. 25 above. (i.e. delete the .exe file in the system 32 file with the rectangular light blue icon) remember the file name. STEP 2 run regedit. Click Start Click Run type "regedit" then expand paths to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run examine the keys and one of them with a system32 path will contain the file name above .exe that you just deleted select the key and delete it. STEP 3 Delete file from STEPS 1 from the recycle bin. Reboot Problem should be solved.

0

After 3 days of trying to rid this thing and following everyones suggestion, I completed steps very similar to Response 13 (Betsy) and FINALLY it worked. I had several culprits and located them by doing a search for all .exe files and then clicking modified date and once that put all files in order I was able to see a large number of files that had similiar icons like someone had mentioned before. I then clicked on the properties of many of them and found they all came from the same company so I deleted them all. Did a run-msconfig and unchecked unfamiliar and same name files I found in my search then restarted the pc. Betsy was right you can't delete one of the files mine was UNONCER because it said windows was using it so you must uncheck it in run-msconfig, then keep doing cntrl alt delete to restart your pc. I couldn't restart my pc the typical way because of the darn pop up. Once I restarted I went back and did another search for UNONCER the one I was not able to delete and then deleted it. Don't forget to empty recycle bin when you initially find and delete the files. I knew I was cured when I restarted and the ACUTULICE box did not load! It took alot but you just have to keep on trying different things. good luck

0

Thanx to Koyurei (nr 25) and Chris C. (nr 43). Looks like I killed "actulice"with their help. On my Win XP is was called 'insw'(by thunderdome), hope I never see it again.

0

Just out of curiosity, does this "actulice modF" box that appears do anything worse to your computer? And how do you get it??? I keep getting it and I have tried many of the tips in here, but my knowledge of computers is very low. I am afraid I will just screw my computer up more if I start unchecking all those things. I hate this. I really want to know what I did to get this. And what the hell it even is

0

Have battled with the actulice pop-up since yesterday in XP Pro and have finally tracked it to a variant .exe file name "DBCJTNWO.exe". Properties indicates a 'thunderdome' derivation and when removed from start up tab and then recycle bin followed by restart resolves the problem. Yadirf's directives in post #3 above is the best method to remove the worm, however tracking down the variations in the name of the actulice file is the trouble. When the pop up is active, ctrl + alt + delete will give you the option to end task, highlight actulice and then select the "process" tab, this will give you the active process associated with the bug. Track this process name down on the start tab of your msconfig and follow Yadirf's directives from there. Funny little bug...

0

We had this little "bug" yesterday...instead of spending all the time trying to find the file, we did a search for all ".exe" files and sorted them by modified date. Then we deleted all the files that had today's (in this case yesterday) date. Curious about this one, how does it propogate? it does not appear to be a worm. it seems more like a spyware trojan.

0

I had the same problem, mine was found under msconfig as "mswspl", I also found a visual basic script file under c:\windows. It was simply called actulice, I noticed it and I deleted it. Spybot did find a file called pg4ds32m and has deleted all it's .dll's and other files attached to it, but there was one file I couldn't delete. A few days later it came back. Thank God I got rid of it now and I hope this story will help somebody out. Good luck from Holland!

0

I actually found the executable and deleted it but that did not work. I tried all the suggestions too but nothing worked except that, when you do a search for all executables by the date that you noticed the pop-up, you get a long list of weird executables. Just delete them all, empty your recycle bin and restart your computer. If you get an error saying you can't delete, go to the task manager and end the process of the particular .exe. By the way, I found that if you just do a search for files without the date of creation to narrow your search, some of them are untraceable. I hope this info helps someone too because my computer was rendered unusable for six hours with this problem.

0

Thank You. I succesfully removed the actulice pop up after following #12 the mutating file name in my case was pxcoinss.exe. The problem I am now having is windows media player will not open and my internet connection is having issues I am connecting to the access point but I cant send and receive E-mails and I cant access the internet. Any Suggestions? Thanks.

0

Dudes, I followed the instructions stated here, specifically Top Speed's to remove this malware. I got myself a good news-bad news situation. Good news - the files, registry keys and the task manager entries have been cleared of this file Bad News - I noticed that my media files (mp3, wma, various movie files) changed icons, specifically the icon where there is no associated program installed to open these file types, and what's more, the windows media player icon changed form it's standard appeareance to that of a setup/install - type file, and when I try to open media player, boom! the horrid things are back... done the stated removal procedures twice and I'm getting the same results... It seems that this program binded with my media player... what should i do about it?

0

Hi . . I just got rid of the pesky little bugger myself (I think) only in my case I'm running windows ME and it was lodged in the Windows/System directory calling itself CAEGT32T.exe . . I get the feeling it uses an alphabet substitution algorithm for all these name changes. At any rate, that half blue icon and the thunderdome creator were dead giveaways, so many thanks to whomever posted that. I unchecked that file in the startup, restarted in safe mode, deleted the file and then cleaned up the startup. So far, so good . .

0

Hello, I too had a problem with the actulice pop-up I finally found the file, in windows/system It was called ctiveskina.exe good luck!

0

From other site i searched Sabaser.exe..because it sounded strange, and it was!!!! i deleted it right now, i wait it works...the properties tell thunderdome.com, actulice, etc, so you can´t get wrong..greetings from Peru

0

I have ZoneAlarm Pro installed on my Win2k server computer. ZoneAlarm Pro found program actulice trying to run the following: C:\WINNT\system32\actulice.exe C:\WINNT\system32\axocmf.exe C:\WINNT\system32\shtmf.exe C:\WINNT\system32\enss.exe C:\WINNT\system32\uicktimeQ.exe C:\WINNT\system32\NMPAPIS.exe Delete these files if you have them. I found another executable in the registry named ejavohkf.exe in C:\WINNT but it might have a different name on your computer. I deleted this line in the registry and found it in WINNT folder. Make sure to delete the actulice.exe file in the WINNT folder. It doesn't hurt to install Adaware and update the reference file then run it. GOOOD LUCK...

0

I am running XP Pro and managed to join the actulice club last night (21 May). I had the usual message boxes but on my system it also tried to connect to the internet every time it popped up, even though I had disconnected manually as soon as I received it. I have Panda antivirus titanium installed, ran a complete system check but failed to find a virus. Spybot also failed to get rid of it, as did Window Washer. Like most people I found it residing in system 32 but could not delete the little f*****. As I am not that computer literate, response 36 by Anssi filled me with hope of an easy fix and it certainly appears to have worked. Well recommended. Good work fella! And a special thank you must go to "thunderdome" for giving me a late night headache and a free membership to the U.K. chapter of this exclusive club!

0

I have followed Chris (no.43) and Kyurei (no.25) advices and get my Win 2000 free from this annoying bug. But I got a little problem while deleting the bug, appears that it has ability to "runaway" while I was attempt to deleting it. I try to delete it(r549b.exe)at place (without moving it), the windows says it couldn't be deleted because used by the system, then the file just dissapear, and change to another name(mload"something".exe), but thanks for Kyurei it still have a same icon, so I move it, delete the file and the running registry (this one also has changing names). And for ashcrimson0083 (no.52), I almost got the same problem, appears the actulice has hijacked my WMP player (ver.9), when I try to running it, it says that the system has error and offers to reinstall it, so just uninstall completly any programs that change to setup program from add/remove program (at control panel), you can reinstall it later. What a happy bug....

0

For Windows 2000. Thank you Koyurei! I did a File or Folder Search for text containing none other than "Actulice" and behold, the ennoying, whatever you want to call it, file appeared. (2 Files, both in c:\winnt\system32, about 68kb in size) 1)Search text for "Actulice" 2)Verify these are the files through properties. (Original file name "Actulice", from Thunderdome.) DON'T CLOSE THAT SEARCH WINDOW 3)Press Ctrl/Alt/Delete 4)Match the name/names of the searched/found files to the files on the processes tab. 5)Right click the matching files from the processes tab listing and select end process. 6)Then go back to your search window and delete the file/files. Last)Empty your recycle bin! This seems to have worked for me. Good luck.

0

The question was asked, but never answered: so what does this little bug DO? Other than having the pain of having it pop up, what's the problem? I read all this crap about how to deal with it (won't someone just make a patch eventually?) and my brain swims.... so what's the cost or potential cost of doing nothing?

0

a firewall sometimes is usefull: zonealarm pro detects the files that actulice uses so, just install zonealarm, block those files, go to the directory that zonealarm provides for you and delete the 'whatever-its-name-is'.exe's. (you may have to terminate it first from memory in Task Manager) Carpe Diem.

0

I just got rid of the actulice pop-up. Here's how I did it and I can assure you, this will work for you whoever you are and regardless of what OP system you are running. Go to your start menu. Select run. Type msconfig and hit enter or OK. When the window opens, select the start up tab. Then what you want to do is maximize this window. If the list of files is short enough to fit your entire screen, hit the print screen button. Now open Word or whatever word processing program you are running. Once your word window is open type ctrl+V. This will paste the file list from the start up window into word. Now you can print the list. You can also just write down the list of files from the start up window if it is short enough of if you cant figure out how to print the screen. Now exit and quit everything and restart your computer. Go back to the start up tab using run msconfig and compare the files in your start up list. One of the names will have changed. Uncheck the box next to that file. Select apply and OK. Write down the name of the file. Restart your computer. Now go to start, find, files, and type the name of the file you found. When your computer finds it, delete it and then also delete it from your trash bin. Close all actulice windows or say OK and restart. It should be gone. By the way, the name of my file was BAR332V.exe located in C:\Windows\System\BAR332V.exe. Your file will probably be called something else but it doesnot matter, just follow these instructions and promise you will be happy.

0

How do you keep from getting this again? I have "modF" not "No modF", does that make a difference? Most important of all: Does this "actulice" pop-up do more than make annoying pop-ups? Flak

0

just another tip to try, Worked for me Start,run, msconfig, Click startup tab and look for any file name with "32" in it. uncheck the box. go back to Start, run, regedit, click (+)on HKEY_LOCAL_MACHINE, click (+)on SOFTWARE, click (+)Microsoft, Click (+)windows, click (+)CurrentVersion, click (+)explorer, and delete folder named "PUP". Reboot your computer. if it works go back to msconfig and write down the file name you unchecked. Do a find file on that file name and delete it. Happy hunting Jumante

0

in startup tab (start, run, msconfig,startup) uncheck autoenrp.exe and it should stop.. Accept startup window changes and reboot. Good luck. JMB

0

Arissi's Response 36 stops this little bugger from popping up in XP by taking it out of the startup BUT it does not remove it from your computer!!!! It just sits there docile. I did the *.exe search and sorted by date and found 4 files with that familiar icon that had been created within the past 6 weeks. The most recent ones had "Thunderdome" in the Properties>Version>Value, but older ones had TotemPole instead of Thunderdome.

0

Here's what I had to do to get rid of it: I'm running Windows 2000 with Office XP. I found "actulice.exe" in the C:\WINNT directory. I searched for a light blue file icon that appears with the popu in the C:\WINNT\System32 directory and found the file "insevntw.exe". File was 68KB, created on May 19, 2004 10:52:00 AM and modified on May 12, 2004 10:52:00 AM. This file is unique to my system. The file get's renamed so you have to find the one with that particular icon. Leave the search windos open. I opened Task Manager, selected "insevntw.exe", then clicked "End Process". I went back and deleted both "insevntw.exe" and actulice.exe". I also searched the registry for "actulice" and deleted the entry there. Finally, I ran Adaware 6 (do the update since it was last updated May 13, 2004). I deleted all the files it found. After this, Media Player would not start. I got a popup saying istallation could not be completed. I uninstalled Windows Media Player, then deleted all files. Five files in the "Windows Media Player" directory would not stay deleted. They would reappear everytime I backed out of the directory and went back in. I rebooted, then downloaded the latest version of Media Player and installed it. I haven't seen the popup again yet. I've got my fingers crossed. The only destruction I've noticed is that it renders Windows Media Player useless. Other than that, it's just very annoying. Good luck and I hope this is useful. webdevmb Colorado Springs, CO

0

i tried what yadirf said to do and my file was sdamg9xm.exe and the date modified was 5/13/04. just around when this started so i deleted it and no problems so far

0

I fully agree with Webdevmb (response 67). I run as well XP and noticed the prob this morning trying to open mp3 files with wmplayer. In windows\system32 was a 68 Kb file called "svcrt40m.exe" (by thunderdome), which was at the same time an active process in the startup tab. Furthermore, there was as well ONLY one file (165 Kb size) in the same folder with the date of today: bdl14026.exe. I deleted both, even from the bin and ... voilà... no more pop-ups for the time being, BUT the wmplayer is still not active. This is an additional problem. I`m sure I need to complete the wmplayer un-install, delete and new install suggested by 67. Good luck to all and greetings from Madrid, SPAIN. Andy.

0

none of your advice worked for me but it set me on the right track i did this open my computer open drive c open windows open system32 leave this open open run on the start menu type msconfig click ok click on the start up tab go back to system32 look for the actulice boxes look for the name under the actulice boxes on the start up tab un tick it's box there will be many of these so do it for each actulice icon in systems32 once your sure there all unticked restart the computer if the pop up returns all actulice files on the start up tab are not unticked if no pop ups appear go back to systems32 and delete all actulice icons empty recycle bin you should now be actulice free

0

I just got rid of actulice following the advice of responder #25. I would add just one useful suggestion: When you arrive in the system 32 folder, go to VIEW to arrange the icons by modified. The culprit file(s) --as described below-- will appear among the most recently dated exe files. *************Anyways - go to "my computer" and into "c drive" into your "windows folder" then into "system 32" look for an rectangle icon with a light blue top, it should look exactly like the one on the actulice pop-up. now you know the name of it !! press "crtl", "alt" and "del" and disable that program then delete it from your system32 folder ************

0

Thanks PRIMETIME, found the little devil at bottom of system32 it's gone now finally Hi everyone, I'm a desperate PC user with a "actulice box" in my face everytime a start my computer. I run on XP Please can someone walk me trought step by step also hanging a lot thank y

0

There are like 100 "little blue boxes" that look like the actulice window... how do I know which one to delete? Thanks again, this this surpassess annoying and goes far into hair pulling. There are like 100 "little blue boxes" that look like the actulice window... how do I know which one to delete? Thanks

0

look for a box that look like all others but his more a light blue Have Fun there his about 1000 files Hi everyone, I'm a desperate PC user with a "actulice box" in my face everytime a start my computer. I run on XP Please can someone walk me trought step by step also hanging a lot thank y

0

I think I just got rid of it. I tried taking a peek at the start up list and found something called "skquotad". The "ad" part at the end struck me as being suspicious, not so much for actulice, but because I've been getting some popup ads lately even though I have the google blocker. So I figured what the heck, and unchecked it and rebooted. The actulice thing always used to come up when I first started up Windows, but this time it didn't. So I tried rebooting again, and still no actulice. So I searched for the filename, found 2 files, deleted both of them, and rebooted one more time. It's only been a couple hours but there's still no sign of actulice. -Chelle

0

I checked my msconfig folder's startup tab but i can't figure out which one is .exe contains the actulice pop-up. I'm afraid to erase any of them b/c I might delete something important. Help me!

0

I'm running on Windows ME. The Actulice virus comes in different names on everyone's server, I believe. No one's going to have the same name twice. Ad Aware didn't catch it, but an aborted Norton Antivirus scan did. Here's what I did in 11 steps: 1. Disable System Restore -(click on 'Start', go to 'Settings', click on 'Control Panel', click on the 'System' icon, click on the 'Performance' tab at the top, click on 'File System' on the bottom, click on the 'Troubleshooting' tab on the right hand top and check the box marked 'Disable System Restore'. The computer will ask you if you want to restart your computer; click on ok.) 2. Go to the 'Start' button. 3. Go to 'Search' 4. Go to 'For Files or Folders' 5. Type in System 32 -You're looking for a small rectangular box slanted at a 45 degree angle, with a light blue stripe on top and white on bottom. Whatever name is next to this box (mine were ICOM4000 and F3216M), you want to look for '68 KB' as the size amount and 'Application' as the description. The date should be whatever today is, I believe the virus normally resets its date. To verify, right click on the name, scroll down to 'Properties' and click on the 'Version' tab at the top, if appliable, for the following: -Company name: thunderdome (or whatever applies, it's just not Microsoft or DirectX) -Internal name: actulice -Original filename: actulice.exe (I believe these are constant; all other values differ from victim to victim.) 6. Delete what you can from these files; I had two. -One brought up a message stating that the program was already in use. 7. Go to the trash/recycle bin icon, right click on the icon and delete the contents inside. 8. Go to 'Start' and shut down the computer like you would normally, EXCEPT that you click on the arrow next to the selection box and pick 'Restart' instead. 9. Hold down the Control key ('Ctrl') until the boot screen comes up. 10. Using the arrow keys, select whatever option is Safe Mode and hit Enter. 11. Redo steps #2 to #7, making sure to delete the contents from the trash/recycle bin. And now you should be fine. In the 10 minutes it took me to write this help guide (and register for this site,) Actulice hasn't popped up once.

0

RESPONCE #73, WRITTEN BY Pinkpillxxoo@yahoo.co: "There are like 100 "little blue boxes" that look like the actulice window... how do I know which one to delete? Thanks again, this this surpassess annoying and goes far into hair pulling." 1. Make sure that it's a slanted rectangular box with a light blue/turquoise/sky blue/baby blue stripe at the top, NOT THE DARK BLUE STRAIGHT ACROSS PERFECTLY NORMAL STRIPE THAT INDICATES A MICROSOFT PROGRAM. Follow my directions and everyone else's in this thread as to verify that those programs are Actulice. 2. If they are, delete them all, and follow everyone's advice on removing the last.

0

I've just formated my HD. It worked well. Hope it can be useful for you.

0

I found that little bugger and it was called SXMLRM. I think it changes with every computer. I went to my c drive then to system (not system 32 on my computer) and i looked for that slanted box with a terquoise strip on the top. Delete it then go to the trash and delete it again. Remember the name and go to the start menu click run type msconfig click ok click on start uo find the name from before uncheck the box restart the computer and you should be good.

0

I installed a free version of Computer Associates anti virus and firewall program to help find the name of the program (it can be downloaded at their web site). Actulice renames itself everytime it pops up. The CA anti virus software didn't find it but when I would reply ok to the actulice popup, the CA firewall would ask if I wanted to allow actulice access to the internet. This message showed the name of the actulice program which at one time was tmdanxxa.exe and then fixdv.exe. It took some time to get rid of it but I finally did.

0

Hi guys, I'm having the same problem with Actulice everyone has been mentioning here. The minute I turn on my computer this Actulice window pops up. I'm new to computers and I would hate to delete something that might be important thus I kindly ask for your help here to my specific request. I have Windows Millennium, and I searched for files or folders with the text in them as pg4ds32m , which someone mentioned it was Actulice. When the search was finished it indicated that a file named USER in my Windows contained such sequence of letters and numbers. I deleted the file but it is still in my trash bin since I'm afraid to completely delete it from my computer, in case I'm making a mistake. In such case, I could just restore it from the trash bin. Could someone tell me if I 've done the right thing by attemting to remove that file? And if so, can you tell me what to do next? or if I did the wrong thing ...What should I do to get rid of Actulice? Please remember I'm running Windows ME and any indications to solve this problem might have to be directed based on such system. Thank you so much in advance.

0

I have been plagued by this actulice pop up for over one week. I tried everyone's advice. The only one that actually worked was Reply Number 77 from POG. Thank you POG. I finally was able to remove this little pest. For anyone else suffering from Actulice, follow POG's steps contained in Number 77. Free at last . . . thank you POG . . . Free at last.

0

Ok, I spent 3 hours deleting over & pup files, found a whatupdmrg.exe file and a few others. I did the misconfiguration thing and ubchecked the boxes. I could not get the computer to shut down because the actulice box wouldn't let it. I was able to get it to shut down by doing ctrl. alt. delete. Then the screen went blank and a message came up saying the machine was dangerlously low on resources and did I want to delete a cw3dsnd file so I hit yes then it restarted and the actul ice box is gone, but the computer still won't shut down properly, plus the defragmenter won't work and when I restart a box comes up saying that the machine is missing shortcut for cwd3dsnd. I don't get it and I wonder if I didn't mess something else up by deleting the cwd3dsnd file. Also the computer is really running slow both on and offline. I think the problem stems from some of these supposed paid email programs that send all those pop up ads. I was looking at one the other night and this box came up to download something and it wouldn't take no for an answer and the box wouldn't close so I hit yes. If I see it again I'm just going to have to ctrl alt del so it hopefully don't come back. Deb

0

I've tried what POG mentioned on response 77 and still it does not show there. The only two slanted rectangular boxes with a light blue stripe at the top and white at the bottom I found, did not contain Actulie as the internal name nor as the original file name either. And although they are application files they are not 68 KB So what do I do? I'm still having this thing bugging me! Thanks

0

An easy resolution. Download this program: http://www.spychecker.com/program/securitytask.html use it to find actulice. When it's found, look to see what the file name is and write it down. Clean the computer using the program. Then go to start, click on run and type msconfig. Find that file and uncheck it. Reboot your computer. Once you are back on, go to search and type in that file name. If found, right click, delete and then delete from recycle bin. Hope this helps!! Dorothy

0

ditto response #86. I run WIN98 SE. When I ran the program, the name of the file found was "actulice". I QUARANTINED it which moved the file to a backup folder and removed it from the AUTORUN registry. It was simple, fast and it worked - no more popup. (I have yet to permanently remove it.) The program also reveals interesting information on other system files. It's shareware and worth it.ks

0

I have finally located the two files containing Actulice within my Windows System. My problem is everytime I try to delete these two files I get a window saying that the file cannot be deleted since it is being used by windows. My question is: How can I delete the Actulice files? I'm running Windows ME. Thanks!

0

I have Xp on my system and when I went to msconfig, the one I had to disable was os411ntd. It seems like different people have to disable different things but that might help. Thanx for the help YADIRF

0

It was called terrabite... thanks for the help! I hope this works! There are like 100 "little blue boxes" that look like the actulice window... how do I know which one to delete? Thanks

0

I did have the same problem from today morning.......and guess what?I didn't do anything ese other than trying to fix the problem. I did...atleast for today. Try this, it might help... 1.click start 2.click Run 3.Type msconfig 4.click the Start Up Tab 5.check for the enabled items and note it down. 6.Restart your sytem without making any changes. 7.Now again follow steps 3 and 4. 8.you should be seeing a different item enabled this time.Make a note of it. 9.Run regedit 10.Type the name of the file you noted. 11.Look for its location and Delete the key. 12.Now go to the location c:windows\system32\the file u noted.exe 13.This file has an icon with a blue line on its top, look for another file with the same icon. 14.Delete both of them.(Shift+ Delete) 15.Restart your Sytem 16.Hope you will be able to smile charurajesh

0

Easy solution, once you've done your best with the intelligent ones: Don't close out of the actulice box when it pops up. Open the task manager (control+alt+delete). Right click on the actulice program, and select 'go to process' The highlighted process is the name of your individual virus. End process (unless you're enjoying having it around) Go to start, search, files and folders. Seach 'my computer' for [enter unique virus name.exe here] Delete. Empty recycle bin. Reboot. Note: I located and deleted all pup.exe and over.exe files first, so follow everyone else's advice before you resort to me This is my smile--> ")

0

I've had the actulice for weeks and used a combination of the many wonderful suggestions above to finally get rid of it. My computer is running on Windows 2000, but the steps should be similar for all others. Here is what I did: 1. I found and got rid of pup.exe To do this: a. Start>Search>For Files & Folders b. Enter "pup" where it says Search for files c. If a "pup.exe" pulls up - delete it. 2. I downloaded the Spyware to find the actulice program (thank you #86). a. Go to http://www.spychecker.com/program/securitytask.html b. After downloading The program will run automatically and will list out all the unregistered programs. c.Look for the file listed as "actulice" d. Write down the file name to reference later. 3. Delete actulice a. Return to the Start>Search>For Files & Folders b. Enter in the name of the file you wrote down. For reference, the name of mine was bdit142k.exe and was found in C:WINNT/System32 file. c. Hit delete Since the actulice opens up only when the computer is restarted, I rebooted and prayed. No actulice window popped up! And if you want be doubly sure - do a search for "pup" and the name of the actulice file you wrote down to see if they reappeared. I hope this does it for you!

0

Just a follow-up to my last message (reply #75). I haven't had the pop up since I did that so apparently it worked. -Chelle

0

Okay, Did what all of you suggested and none of those directories were on there. Called my wife's uncle (computer genius) and he told me it sounds like a virus, maybe a worm. Don't try and delete anything from your computer!!!!!! In the long run it could make things worse!! Get a free Anti-virus scan and disinfectant (not the crap in a can) and make sure you have a spyware killer. He suggested Spybot search and destroy (spyware eliminator). Don't be confused by similar types like Spykiller. Make sure it is Spybot S&D, it is totally free for updates and elimination of spyware. He suggested Avast anti-virus. This scans and disinfects viruses. it is free for personal computers but costs money for commercial use. Updates are free and no costs for removal. Now on to what I found out about this nasty little bug. It is known as the Trojen or generically as the Trojeno virus. When I finally was able to run Avast, I found that it not only ate into windows but it infected every single DOS file and about 75% of windows files. It was so bad it was downloading toolbars, and was able to push ANY AD past my pop-up blocker. If your still emotionally feeling vulnerable after these two downloads then get Spyware Blaster as well as Spybot. It helps keep the spyware off the harddrive where the virus got in in the first place. Feel free to respond back if there are questions John

0

What caused this in the first place? I don't want it to happen again. Flak

0

Ok to get rid of actulice(which is more than just a pop-up: it causes processes in the Task Manager to run randomly) you have to get the task manager up (CLT-ALT-DEL) when the pop-up appears. Select the actulice application and then right-click to get a menu up. Select "Go to process" and the dodgy process will be highlighted, then search for that file using the windows search program and delete it. P.S. The pop-up uses different file names for different computers.

0

I'm really going nuts! I followed ALL your directions and have located 4 of those rectangular thingies in System 32 ... Definitely Actulic ... Now my problem is, it will not let me delete them. I have tried several ways to delete them and I am being denied access. Now what can I do? Thank you all!!!!

0

I have tried these things and got the pop-up to go away...BUT now my internet does not work properly. I got rid of it by finding out the file name and then unchecking the box under the startup tab in the system configuration utility, then I deleted the file, and since then when I try to connect to the internet, my computer says it is connected but will not pull up any page or my buddy list. Please help me with any suggestions! By the way I am running XP.

0

I followed your advice jackmac217 and downloaded Spybot S&D and it found a helluva lot of problems but I still have the actulice problem, when I "fix the problems" it seems to fix everything except what it calls a possible hijacker.is there any way to sort this.I'm really lame on a computer and this Actulice thing is worrying me now, I've tried the majority or the suggestions on this website but None of them have worked!?! Please someone help! Yours faithfully the Gigaman Gregs

0

GUYS!!!!!! ive got it sorted, try this site. itll help. http://blog.badangel.org.uk/index.php?p=324

0

Hey, I found the "thurnderdome" files on my computer, and I was able to delete one of them, but one called "netsrvi" wont allow me to delete it. Any advice?

0

Ad-Aware from LavaSoftUSA finally cleared this pesky pop up from one of our computers running Win98. tks

0

Thank you to all for the great suggestions. I followed the advice of Reply #2, and found four different icons in my system 32 file that were different in appearance, and the company name in their properties was either thunderdome or totempole. The file names were different from any you all found. mvcore2w.exe, asmansr.exe, eroCheckN.exe, and ecupds.exe. the last one was also on my system startup list. I also found an empty Desktop shortcut to an empty file called "~". Make sure that whatever you do, do it in safe mode and turn off you system restore until you are finished.

0

waz up everybody i have a problem with the dumb actulice pop up i use the 1-9nstep on respones #2 on the page on step # 6 i could not find pg4d532m in the list! could someone please help me!

0

i know i am repeating flak but the question wasn't answered and i want to know the answer too: what causes actulice in the first place

0

in addition to my response (number 105) what causes actulice and why does it keep on poping up? if someone knows email me! (click on my name then click on my email address)

0

I've got the d*mn thing too ...and it comes up in multiples ..arghhh..I'm going to go "drink Joe's reported water" and will be back to tell my results; Oh, and comment to adaware ....I've got it...have run it ... and it does NOT get rid of lice (actulice) . ...our lies so sincere, thus honesty that we fear...

0

Guys I'm having trouble finding the d*mn thing.. (BTW I'm on windows 2000) my comp won't even find msconfig.. I'm so confused. is there different steps to take when trying to get rid of it from win2000?

0

Response 101 got rid of actulice for me! Thank you sooooooo very much!!!! Somehow an AOL .dll file was deleted and if that happens to you, you do not need to reinstall AOL ... Simply go to this free .dll site ... http://www.dynamiclink.nl/htmfiles/dll-i.htm Thank you all again and let's hope we stay Actulice FREEEEEEEEEE!!!

0

using #25, here's what fixed my "lice" go to "my computer" and into "c drive" into your "windows folder" then into "system 32" look for an rectangle icon with a light blue top, it should look exactly like the one on the actulice pop-up. right click on each and delete...don't forget to empty trash. if you run across a icon that will not allow deletion due to "in use", ctrl-alt-del and end that process. once the process is ended, go back to sys32 folder and right click on the pesky icon, delete with extreme prejudice and empty the trash. this appears to solve my issue...for now...thanks to all who posted on this.

0

Seriouslly guys, you are trying to hard to fix your problems the extremely hard way. Go to response number 95 and try what I have said. These programs are designed to do the deleteing for you. If you go and delete stuff yourself there is a good possibility that you could mess up your entire operating system in the long run. Avast is a really neat virus seeker/destroyer. During the first week or two it will seem like it pops up evey two minutes telling you that it found a virus (more than likely the Trojen or it's generic form Trojeno) but after that it won't find anything for a long while. Just go to response 95 and trust me. John

0