Hello, I have recently been having problems when on the internet, or should I say trying to get on it. I have discovered a new program that seems to be causing problems. nap.exe. I recently discovered it in the start up. The file is nap.exe and its in my Windows\System directory, and it's about 61k. Recently I was on dialup and this program connects to the internet when I'm already on and another part of it acts as a server and listens on port 12398 I believe it is. When I disallowed nap.exe server privelages with my firewall I got an illegal operation with runDLL32 and then I get an error whenever I try running an apllication. When I let it have access it slowed my computer down and it eventually crashed. It seems to start itself up even though I removed it from the start-up./ As if it automatically detects when am on the internet then automatically loads up. I am now on DSL and when I log-in and I'm on the net it loads itself up multiple times and slows everything down and within 2mins my computer is frozen or slowed to the point that I cannot do anything. I have tried deleting the file from within windows and it says that windows is using it so it cannot be deleted also from Safe mode and mos DOS, and mos DOS when I boot from the win98 cd. I am running Windows 98 Second Edition. PIII 600MhZ 190MB RAM (If it matters) Can someone please give me help, I would appreciate it very much. If you can...e-mail me. TheSickChild69@hotmail.com

It's sure to be a Trojan. Why aren't you running your antivirus to confirm? Also try The Cleaner at http://www.moosoft.com/download.php Free Antivirus here http://antivirus.cai.com/ If after removal, you have trouble running programs, download and run EXEFIX08 from here http://home.earthlink.net/~rmbox/Reticulated/Toys.html

1. Shutdown and restart the computer in Safe Mode A. If your computer is on, click on the Start button. The Start menu will appear. (If your computer is off skip to step E.) B. Select Shut Down from the menu. The 'Shut Down Windows' dialog box will appear. C. Select 'Shut down' and click the Yes (or OK) button. Manual Removal of a Trojan Virus D. Wait until the "It is now safe to turn off the computer" message appears and turn the computer off. Read steps E-H before continuing. E. Turn the computer back on. F. Immediately begin pressing the F8 key, every other second, until the Windows Startup menu appears. G. Press 3 and then Enter to start the computer in Safe Mode. H. Once Windows starts, an information message will appear explaining Safe Mode. Click the OK button to clear this message. The computer is now in Safe Mode. 2. Click on the Start button, then on Find, then on Find Files or Folders. 3. Type in "win.ini" into the Named line, select C: in the Look In line by clicking on the down arrow next to the line and press Find Now. 4. Once the file has been found it will appear below. Right click on it and click on properties. 5. On the bottom of the window a section titled Attributes gives several options. Be sure the Read-only box is unchecked. 6. Click on OK to exit the properties window. 7. Click on the Start button, then click on Run. Type "sysedit" in the run field and click on Ok. 8. The System Configuration Editor will appear with six windows found stacked on top of one another. Close the first two windows by clicking on the "X" in the upper-right-hand corner. The "C:\windows\WIN.INI" window will be selected for editing. 9. Locate the line that begins with "load=". Place a semicolon (;) in front of the line so that it reads: ;load=(other text may remain here) Write this line down. You will be using this information later. NOTE: Many trojan viruses use the load= line. This line is also used occasionally by other programs, so it could contain both trojans and valid programs. Inserting a semicolon will prevent trojan files from loading but it may also disable functions of other programs. After completing this process and rebooting Windows, if you recognize that a valid program will not load normally contact the manufacturer of that program. When contacting them, ask if an entry for their program should be placed in the load= line. 10. Locate the line that begins with "run=". Place a semicolon (;) in front of the line so that it reads: ;run=(other text may remain here) Write this line down also. You will be using this information later. NOTE: The above note also applies to the run= line. 11. Click on File in the upper-left corner and click Save. 12. If you do not see anything next to "load=" or "run=", close the WIN.INI by clicking on the "X" in the upper-right corner. "C:\windows\SYSTEM.INI" will be the window open for editing. 13. Locate the line that begins with "shell=explorer.exe". 14. If there is anything written after "shell=explorer.exe" write it down (usually something like: Winsyst.exe). If there, "Winsyst.exe" is the name of a trojan that is infecting your computer and you will need to search for it in step 18 below. Now with that written down, erase everything written after "shell=explorer.exe" on that line. (Be absolutely sure you leave "shell=explorer.exe" and subsequent lines). 15. Click on File in the upper left hand corner and then click save. 16. Close the system configuration editor by clicking on the "X" in the upper-right corner. 17. For complete disinfection, you need to remove the virus files. After rebooting the computer, click the Start button, click on Find, then click on Files or folders. This opens the Find utility on your screen. NOTE: To determine the name of the infecting trojan file so you can type it into the Find utility, refer to the lines you wrote down in steps 9 and 10 above. Entries in the load= and run= lines are paths that point to a specific file and tell it to run. A path starts with a drive letter and ends with the name of the file being run. For example, if you see "C:\windows\temp\pkg3243.exe", then pkg3243.exe is what you would enter into the Find box. This is the name of the trojan infecting your computer. this wasnt written by me, it was on a post I copied

Do you have any Links products on your computer like links to smtp? I really don't think you have a virus.

I don't have any links products that I know of. But is there a way to check? I have scanned the file with the most up to date virus scanner and it doesn't detect it as a virus or trojan or anything. I checked the properties on it and it said that it was created march 9 2001, if that helps. I do not remember downloading nap.exe itself but it may have been packed with something else, I'm not sure/ Anyone have any ideas? I'm almost desperate.

try Ad-Aware from lavasoft, its a spy ware remover might help you http://www.lavasoft.de/

Look at this site: http://www.support.lotus.com/sims2.nsf/7a90a982f56a757b852566fa005f8d7e/bd5eefcaa71e0f8a8825663400634bc5?OpenDocument