Comments on: run-mbi16.exe virus/worm/trojan

Question: run-mbi16.exe virus/worm/trojan

Kwantsar — Wed, 23 Nov 2005 09:59:21 -0800

run-mbi16.exe virus/worm/trojan

I don't know what run-mbi16.exe does, and neither does the internet, as far as I can tell. AdAware tries to kill it but it reappears on reboot. I can kill the process manually every time I start my machine, but as you might imagine, that seems to be an inferior long-term solution.

Little help?

By: rolypolyman

rolypolyman — Wed, 23 Nov 2005 10:06:59 -0800

If it's a matter of just killing a process, HijackThis should be able to fix it so that it is permanently disabled.

By: chuma

chuma — Wed, 23 Nov 2005 10:07:43 -0800

No idea what this is, but if you need help tracking down how it is being run I suggest you check out this list of places that viruses and trojans hide on startup. Might have some places that you haven't looked yet.

By: blink_left

blink_left — Wed, 23 Nov 2005 10:45:03 -0800

I am drawing a blank with my sources. Most of the anti-virus, spyware companies are fast listing problem programs.
So i wonder: Could it be part of some software you are running(ie not bad)? Have you done a search to see where on your hard drive it lives? Do you use a french trackball, if yes there is one with the model MBI 16? Need more clues...........

By: rolypolyman

rolypolyman — Wed, 23 Nov 2005 10:55:11 -0800

To add to what blink_left said, once you find the file in Search or File Explorer, look at it's File Created date. Then do a disk-wide search for all files created on that date. This can give you some idea of what it was packaged with, or how it got there.

By: rolypolyman

rolypolyman — Wed, 23 Nov 2005 10:56:38 -0800

clarification: to get the File Created date, right-click on the file to bring up its properties

By: stovenator

stovenator — Wed, 23 Nov 2005 11:05:24 -0800

It could be something that renames itself differently on every infected machine.

Can you find the .exe , right click on it, go to properties, and see if there's any other info?

Look for the description, or check all of the info on the Version tab. Is it digitally signed? (most likely not)

By: elpapacito

elpapacito — Wed, 23 Nov 2005 16:38:40 -0800

kwan: plz provide all the details adware spits out when manipualting the object while you try this german ware which rules.