Hi Geoff,
This file as far as i know is connected to spyware
dialer's its used by 2 that i know of and although its
saying it cannot be found id still advise checking for
the other files.It could be genuine but there again could
be related to these:
123Messenger
Related files: 123messenger.per, licencia.txt,
msa64chk.dll, msapasrc.dll, telefonos.txt, textos.txt
123Messenger properties:
.. Hides from the user
.. Stays resident in background
AND:
Mostrar Dialer,
Related files: MSA64CHK.DLL, msapasrc.dll
Mostrar Dialer description: Mostrar is a dialer used by
porn sites. It downloads a file named msapasrc.dll on the
system. The file implements search hooks to monitor the
data entered in the address bar,it installs itself and
attempts to use the modem to dial to a pay telephone
number.
Manual Removal incase it is one of these:
Enable viewing of hidden files and folders and
extensions;Start Windows Explorer and click on
your main hard drive, usually c:\. Then select Tools from
the top of Windows Explorer and then Folder Options. Go
to the View tab. Scroll down to the folder icon that says
Hidden files and folders and check show hidden files and
folders. Also, right below it, uncheck the hide file
extensions for known types.
Search for and delete These files:
123messenger.per, licencia.txt, msa64chk.dll,
msapasrc.dll, telefonos.txt, textos.txt
For Mostrar Dialer:
This involves using Regedit
Go to Start then to run and type
Regedit
If you havent used regedit before its easy enough to use.
(Example:for the entry below,Go to HKEY_LOCAL_MACHINE
then click the plus (+) beside it,Then go to SOFTWARE and
click the plus (+) Then to CLASSES and again the plus (+)
Then finally to CLSID and find the entry listed and
delete it.For tthe second entry it works the same way but
this time open all the folders listed by pressing +
untill you get to the RUN folder then in the right pane
delete the names listed)
Delete 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Classes \ CLSID
{582788CA-7014-4904-A4EE-6FB6108AFE8E}'
Browse to the key:
'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \
CurrentVersion \ Run'
Delete the value 'MP3NumberOne' or 'ContentDownload'
Then search for this file and delete it if it still
remains if you removed 123 messenger first this will have
gone with it but check to make sure.
Delete file:
MSA64CHK.DLL
Also Check the Downloaded Program Files in the Windows
Folder and remove this if found 'Marcador Class'
This is a high security risk if it is these dialers
especially the second one as they can download and
execute code without your consent also it can affect
Windows code-signing system so that its manufacturers are
considered 'Trusted publishers' and can install further
software from any web page,so you need to check for these.
There might be genuine Microsoft files by this name as i
havent checked but i know of these dialers so wanted to
post removal instructions incase you have them installed.
If you need any help reply and i will assist where i can
Andy
