Computing.Net > Forums > Windows 95/98 > Help! IPF with "winras.exe"........I"m clueless!

Computer Problems? Computing.Net has over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to start participating now! Also, be sure to check out the New User Guide.

Help! IPF with "winras.exe"........I"m clueless!

Reply to Message Icon

Name: Brad Rakes
Date: March 30, 1999 at 19:07:38 Pacific
Comment:

Here is the situation: Starting two days ago, I began getting an error message saying winras.exe caused an invalid page fault. This error message now comes up about once every single freaking minute! I cannot do scandisk, because it keeps getting interrupted saying that something is writing to my hard drive. The longer I have my computer on (and the more "winras.exe" IPFs I get, the worse my system performance gets. I also get kernel32.dll IPFs every now and then, too. Programs that used to work fine now say I don't have enough system resources (and I'm running a powerhouse maching). I finally just renamed winras.exe so it wouldn't run, but I still get memory error messages and performance is still crappy, so I've just hidden the problem. Does anyone know what winras.exe is and what is causing this problem? It's annoying as crap............



Sponsored Link
Ads by Google

Response Number 1
Name: Alan Bannet
Date: March 31, 1999 at 23:31:21 Pacific
Reply:

Well, considering you didn't give me any error messages, I'll do the best I can to help you. What it sounds like the problem is is a problem with Kernel32.dll. I know for a fact that in Windows 95 (I'm not sure what operating system you're using, you didn't say) there is a memory leak problem with Kernel32.dll. What this means is that if you use a program for an extended period of time, it can completely drain the system resources. This could be causing problems in winras.exe. However, I don't suspect it's this. But, just to be sure, download the fixed version of Kernel32.dll from:

http://support.microsoft.com/download/support/mslfiles/Krnlupd.exe

Now, if this doesn't work (and I suspect it won't), then the problem is in your memory usage. Hit alt-control-delete and see what programs are running. I'm willing to bet that you have a number of programs that you don't need running. You should only have Explorer and Systray in the pop-up box. Hit end task on everything else. If you have two explorers open (I've run into this problem numerous times) then close the one that is furthest to the bottom of the list. This is probably your problem, and this should free up memory. However, if this is the case, chances are that you'll need to do this everytime you start up. To fix that, I'd have to look at your WIN.INI files, and that's just getting into too much depth. Good luck fixing this problem.

Best Wishes,
-Alan Bannet


0

Response Number 2
Name: derek dunaway
Date: December 1, 1999 at 14:51:04 Pacific
Reply:

winras.exe in a myterious file that "every-once-in-a-while" gets put in the windows\system dir. I've seen it a few times. It should NOT be there if you never intended to be a Remote Access Server a.k.a. RAS (and U probably didn't). It's a "backdoor" type program to allow outside access to your computer (kind of "backorifice lite"). Watch out for the "rouge" better known as warez sites as they know how to "invade" you thru your browser, and put these kind of things there. You see running it if you run Wintop. Sometimes it runs intermittently - evidenced by the mouse curser as an hourglass for a few seconds about every 5 to 10 minutes.
Shut down and reboot to "command prompt only", go to windows\system and rename this file to winras.exi (don't delete it just yet in case its supposed to be there(but i doubt it)). Delete it sometime later (a few weeks or so) when you "know" its not needed)
P.S. I never did.
P.S.S. Watch out for VNC also.


0

Response Number 3
Name: Rob Hoffman
Date: December 17, 1999 at 10:04:27 Pacific
Reply:

I located this charmer running on a system this morning, and found some interesting information besides. The system was experiencing a drastic slowdown, and Ctrl-Alt-Del showed two unknown items running: "winras" and "ver_chk".

I checked the normal load locations: win.ini, autoexec/config, registry, and found that only "ver_chk" was referenced in the registry at \HKU\Default\Software\Microsoft\Windows\CurrentVersion\Run => C:\windows\system\ver_chk.exe. I used my trusty hex editor to view the file, and found references to a program/Web site called CyberAudio Library. It also contained references to "winras.exe". Since CAL isn't currently installed, I moved those files along with "du_cal.exe" (referenced to in ver_chk as well) out of \windows\system to a temporary folder, removed the references in the registry, and rebooted. So far, no ill effects, and no additional instances of either.


0

Response Number 4
Name: Will
Date: March 25, 2000 at 10:02:57 Pacific
Reply:

I found the aforementioned winras.exe and ver_chk.exe files in the system directory on my fiance's computer. Her system runs very little on it other than some games and applications.. the only things normally in startup are Intellipoint drivers and antivirus software. I removed both files from her system directory and submitted them to sarc.com to get an auto-reply that neither files had virii in them. I don't quite believe their AI. I found ver_chk.exe in the same key mentioned above. Upon removing the reference to that "Windows Version Checker", neither winras nor ver_chk loaded on next boot, and everything seems fine. Any of the software she's run on her PC has been run on mine, so i can't figure out where these files came from. I did not, however, find the du_cal.exe file on her system. I have kept the files, and if you would like them for comparison to yours, i'd be happy to send them to you. Perhaps we should get a human to analyze these files for trojan-like activity.


0

Response Number 5
Name: steven
Date: May 21, 2000 at 00:37:53 Pacific
Reply:

i have also noticed these files appear in the alt+ctrl+del menu
i think they do have someting to do with a trojan
2 days ago my icq password and hotmail password were hacked
i have also noticed that when i closed winras i heard a siren noise?
if anyone knows what this is and how to get rid of it i would like a reply
thank you


0

Related Posts

See More



Response Number 6
Name: Brian O'connell
Date: May 31, 2000 at 00:11:00 Pacific
Reply:

Here's a relatively simple solution.

While it's been some time since I used Win95, under Win98, click Start> Run... In the window that pops up, type "msconfig"... Click the System.ini tab, and then double click the "Boot" entry.

You should see listings for EVERYTHING that loads on startup. Uncheck the entries for "ver_chk.exe" and "winras.exe", then click the "Apply" button, and click "OK".

As the program closes, it'll ask you if you wish to reboot. Go ahead and reboot, and those two apps won't bug you any longer...

As said, I forget if Win95 handles this as cleanly, if it does, then no probs, it also automatically shifts the registry entries for the two apps to an unused section (presumably for the purpose of debugging your system, but seperate from regular Windows operations).

A bit late, but hopefully this helps others in the future...


0

Response Number 7
Name: Jonas Grumby
Date: June 22, 2000 at 10:10:55 Pacific
Reply:

I recently found the aforementioned files on my machine and was curious about their origin. I used a hex editor to peek inside both ver_chk.exe and dn_cal.exe. As mentioned previously, these files are components of a product called "CyberAudioLibrary". The author (and copyright holder) is Timofei Mouraveiko. References are made to several servers and domain names including ari-net.com, cfriends.com, and cyberaudiolibrary.com. After doing a little digging in DNS records, it appears that CyberAudioLibrary, Inc. (http://www.cyberaudiolibrary.com or http://cal.ari-net.com) is a company owned and operated by Computer Friends, Inc. of Portland, OR (http://www.cfriends.com).

In browsing the website at http://www.cyberaudiolibrary.com, it appears that the program is some sort of service for sharing audio files (.MP3's, etc.). Something similar to Napster, I suppose, except that CyberAudioLibrary is a fee-based service. Visit the website for more info.

The website does list directions for uninstalling the software. However, it refers to the use of Windows' Add/Remove Programs control panel and/or the uninstall function within the program group. In my case, since I never actually installed this software, no uninstall program or entry existed.

In looking at the dependent applications for each of the CyberAudioLibrary components, it seems that it utilizes many different Windows system DLLs. In particular, ver_chk.exe showed extensive usage of wsock32.dll (BSD socket API for Windows).

I searched for files and registry entries related to CyberAudioLibrary and came up with the following list of items to delete. Note that this list may not be complete, especially if you actually installed CyberAudioLibrary from the setup files.

Uninstallation:

1. Remove the registry value HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run\Windows Version Check. This will prevent the program from starting when Windows is loading.

2. Remove the registry key HKEY_USERS\.Default\Software\CyberAudioLibrary

3. If ver_chk.exe, dn_cal.exe, and/or winras.exe are currently running, you will need to restart Windows before continuing.

4. Delete the following files from your computer (normally found in the Windows\System directory): ver_chk.exe, dn_cal.exe, and winras.exe.


I still don't know how these components were installed on my machine, but I suspect it was bundled with other Internet shareware.

If you want to contact CyberAudioLibrary, I found the e-mail address cal-tech@cfriends.com. You could also contact Computer Friends, Inc. at the following address:

Computer Friends, Inc.
13865 NW Cornell Rd
Portland, OR 97229
503-627-0998 or 503-626-2291


0

Response Number 8
Name: kevin austin
Date: September 11, 2000 at 06:20:54 Pacific
Reply:

See QAZ Trojan virus notes @ Norton AV. It uses WinRas and Ver_chk to open a backdoor to your PC. Sends your IP address to virus author. No file damage but allows hacks to yoour pc whenever connected to internet.
Good luck,

Tex


0

Response Number 9
Name: Maze Of Chaos
Date: November 29, 2000 at 11:54:38 Pacific
Reply:

I know for a fact that Ver_chk.exe is not a Trojan, it is used by your virus scanner (ex. Mcafee, Norton etc.) this can be deleted but be aware that doing so makes you really easily hacked, WinRas I also found on my computer, I always noticed it, figured it was suppose to be there, since WIN was part of the name, I haven't tried turning it off, and prolly won't until someone gets through my firewall, I have a very powerful firewal because well cable runs all the time, so I'm always able to get viruses, I also use McAfee virusscan


0

Response Number 10
Name: Sam
Date: December 24, 2000 at 17:38:46 Pacific
Reply:

I am triing to locate a copy of dn_cal.exe
I used to have it beofore, and cant seem to download it off the site. if anyone has it can you please help me out?

by the way. as far as I know it's a legit comp that hosts files for you, the dn_cal.exe is a small prog that downloads and installs the C.A.L. interface so you can host/share files on C.A.L.'s servers.
there might have been a couple bugs in the C.A.L. interface prog, thats why some might have had errors with du_cal


0

Sponsored Link
Ads by Google
Reply to Message Icon






Post Locked

This post is quite old and has been locked from receiving new replies. Please create a new posting instead.


Go to Windows 95/98 Forum Home


Sponsored links

Ads by Google


Results for: Help! IPF with "winras.exe"........I"m clueless!

please help me with networking www.computing.net/answers/windows-95/please-help-me-with-networking/26884.html

How to re-install Info32.exe? www.computing.net/answers/windows-95/how-to-reinstall-info32exe/149156.html

help with a conagent.exe file? www.computing.net/answers/windows-95/help-with-a-conagentexe-file/158670.html