Actulice worm or virus
When you search for this file "actulice.exe",are you
setting your options for Explorer to show all / hidden /
Go to Explorer --> Tools --> Folder Options --> View and
make sure that you have selected to show hidden, system,
and operating system files. After you have done this,
search for "actulice.exe". It may simply have the "hidden"
> search for "actulice.exe". It may simply have the "hidden"
I couldn't find it either, but I found xtrac32e.exe which I think is
that program. I deleting that file and it seems to help. Also search
for pup.exe and delete them too.
I had the same problem.
Take a look in your registry at this key:
You'll see an entry for BDALK.exe
Then remove the file that the entry is pointing to, e.g., Windows\system32\b
That should solve the problem.
this is an addendum to my previous posting. It looks like actulice
occurs in many places, not just the BDLK.exe
For example, there is another registry entry for emotespr which runs
emotespr.exe which also runs the actulice popup.
In general, go through the
and looks for anything you didn't put there.
make sure you understand each entry.
Delete the reg key and the file for anything you can't verify that
looks suspicious. Remember what you did in case you need to reverse
For what it's worth, this trojan/worm or whatever it is seems to
morph. There's a thread at
http://www.computing.net/security/w..rum/11733.html. The fix
is somewhat intensive. Here's what I had to do to get rid of it:
I'm running Windows 2000 with Office XP.
I found "actulice.exe" in the C:\WINNT directory. I searched for a
light blue file icon that appears with the popu in the
C:\WINNT\System32 directory and found the file "insevntw.exe". File
was 68KB, created on May 19, 2004 10:52:00 AM and modified on May 12,
2004 10:52:00 AM. This file is unique to my system. The file get's
renamed so you have to find the one with that particular icon. Leave
the search windos open.
I opened Task Manager, selected "insevntw.exe", then clicked "End
Process". I went back and deleted both "insevntw.exe" and
actulice.exe". I also searched the registry for "actulice" and deleted
the entry there. Finally, I ran Adaware 6 (do the update since it was
last updated May 13, 2004). I deleted all the files it found.
After this, Media Player would not start. I got a popup saying
istallation could not be completed. I uninstalled Windows Media
Player, then deleted all files. Five files in the "Windows Media
Player" directory would not stay deleted. They would reappear
everytime I backed out of the directory and went back in. I rebooted,
then downloaded the latest version of Media Player and installed it.
I haven't seen the popup again yet. I've got my fingers crossed.
The only destruction I've noticed is that it renders Windows Media
Player useless. Other than that, it's just very annoying.
Good luck and I hope this is useful.
Was this reply helpful? (0) (0)