Topic awaiting preservation: OWMNGR.EXE!!!!!!

ok i dont know if this is as urgent as i think it is but im pretty sure theres a mass trojan going around. Weird things are happening i think it involves kazaa. This thing called owmngr kept trying to access the internet so i started blocking it. so i went onto google and searched for owmngr and nothing turned up. so then i went onto usenet and did the same and i think its 5 entries today for owmngr. the owmngr which placed itself in my C:\Windows\System was created today. and kazaa is giving out extra warnings about vulnerabilities when it starts up. So I update my virus scanner and lo and behold 2 of the viruses it found were .dat files in my shared folder. So i thought the kazaa alerts were just Sharmanwanting to give me more adware but after what had already happened i downloaded it and on cable it was giving it to me about 1 kbps on cable. Those kazaa servers must be beasts too so i thought this was kind of weird. Also, some adware id been having problems with on my machine called Virtual Bouncer was getting cocky. Before it would just jump around in temp files but it actually created a program files entry. If anyones having similar experiences please share them.

------------------------------------
Now Officially Superior!

Got Kaz, but a search for the file didn't trun anything up. also, did a scan, but turned up nothing yet. have you downloaded Kazaa's update yet? I did, nothing seems to be wrong with it.

platyjim: I'd recommend getting rid of Kazaa and installing Kazaalite - run something like adaware too to try and clear up and nasties you may have acquired.

___________________
Emps

FAQs: Emperor

I would recommend getting the program Spybot: Search and Destroy to get the spyware and then get kazaalite from kazaalite.com

I just now got this trojan and I've NEVER used a file sharing Kazaa service or anything similar so it's not just there. Now...how to "fix" it as these stupid trojans cannot be repaired. Is there a file that needs to be deleted or does this one screw with your registry files too? Uggghhh!

here you should find information on how to remove this trojan, aeroluvr.
I also recomend the online virus scanner at housecall.antivirus.com - always up to date virus definitions, only a couple of minutes of it downloading itself before starting to scan, free. And as far as I can tell, always a link with technical background for any virus it finds.

so long,
Tyberius Prime

Oh, and welcome to the asylum!

I have been having problems with owmngr.exe for sometime now on my work computer and I don't have Kazaa installed on it.. On my home computer where I do have Kazaalite installed I have never had a problem with it.. The only way I found to get rid of it is to search my registry for it and deleat it from where ever I find it, but that only works temperarly. I also deleat it from my windows system file where it resides.. I don't know where it comes from and its really starting to bug me.. If anyone knows how to get rid of it good please pass on the info..

colepper, welcome to the asylum, and read that link I posted above.
It contains detailed instructions to get rid of it.
If you keep on getting infected, it's time to invest into anti-virus software,
which might very well be able to tell you where the infection is coming from.

OWMngr.exe is obtained through visiting websites on Internet Explorer or through HTML based Emails.

This is a good place to read up on how to stop and remove OWMngr.exe and stuff from your system.
http://www.annoyances.org/exec/forum/win2000/n1054427699

Basically what you want to do is CTRL+ALT+DELETE click on OMWngr and End Task, Wait about 10 seconds and a "Program Not Responding" message will pop up, Click End Task to stop it from running, Go to your Windows/System or Windows/System32 folder and Delete it, then go to START -> FIND -> FILES OR FOLDERS, type in OWMngr and a file that is located in Windows/APPLOG (I believe) will show (possibly more files) Delete all files that are named OWMngr.

I've recently (yesterday) found a new Trojan Adware program that will open up advertisements in windows in the shape of a rectangle (usually with neon colored up-down scrolling bar) and when you ALT+TAB it shows the icon of 2 arrows pointing towards each other.

If you have this also go to Windows/System or Windows/System32 (Have Show All Files selecting in Folder Options) and find the double arrow icon (I deleted it before writing this) and CTRL+ALT+DELETE the program from your Task Manager, then delete the file and go to START -> FIND -> FILES OR FOLDERS and search for the name of the double arrow program you just deleted (or are going to) and it will have a file located in Windows/APPLOG, delete that one too.

------------

I have also found a program named Popunder that makes advertisements popup under whatever programs you are running and minimizes them. I dont remember what I did to get rid of it, I think I just deleted it.

Well I hope this helps some. If any questions just ask.

Use Kazaa Lite... use spybot search and destroy... use antivirus... get a firewall... DON'T use internet explorer...

Looks like I'm all set! So what's this trojan y'all are talkin about?

Uhh OWMngr is the trojan...

Eh? Is that right?

Haven't heard of it...

Yep, OWMngr is a Trojan that runs independently off of Internet Explorer and causes PopUps and gets REALLY annoying.
And since it runs independently off of IE, Ad-Aware and Spyware programs cant/wont detect it.


I remembered the other file similar to OWMngr, its named OnSrvr. You can remove it by reading my post above. Basically if you have 1 or both of these programs on your computer they will activate each other when 1 or the other is disabled (via End Task) and plague you with more PopUps.


For those of you who STILL get PopUps and notice seeing Trafficsyndicate.com or similar go to CONTROL PANEL -> ADD/REMOVE PROGRAMS and select TOOLS FOR EXPLORER (or similar) and it will open a window that looks like it may be an actual Microsoft site (Sky blue / white color scheme) click UNINSTALLATION then click the Radial button that says Remove, not disable because it'll still run if you disable it.