Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Protector.exe driveing McAfee (and Me) crazy.

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Protector.exe driveing McAfee (and Me) crazy.

Unread postby narnsmarn » October 4th, 2006, 8:37 am

Yesterday my son was using his computer and came to me complaining that there was a McAfee warning he could not get rid of.

Sure enough the message that c:windows/system32/protector.exe" is trying to access the internet was there. Selecting any of the options presented (ie. block all access) did nothing and the message pops up every 20-30 seconds.

I have updated and run McAfee virus scan and updated the firewall. No good, same message. I have also updated and run zoftspy, no good. Those two aps show the computer as being clean, but this problem persists.

I can find no process by this name in task manager and can locate no program by this name anywhere on the box.

I can find no useful information on this problem via Google and haven't come across a similar problem on this board (I will admit my search hasn't been exhaustive).

Has anyone heard of this in the past, and have you any idea where I should go from here?

Great board by the way. Nice to see y'all helping out folks like me.
narnsmarn
Active Member
 
Posts: 3
Joined: October 4th, 2006, 8:22 am
Advertisement
Register to Remove

Unread postby ChrisRLG » October 4th, 2006, 8:58 am

We need a hijackthis log for diagnosis.

http://www.malwareremoval.com/forum/viewtopic.php?p=39#39

At the bottom of that post is instructions on where to get HJT etc.
If you have a problem with it - check out the 'nellie2 on the web' link near the top of the forum - she has a very good tutorial.

Please post as a reply to this topic
ChrisRLG
Administrator Emeritus
 
Posts: 17759
Joined: December 16th, 2004, 10:04 am
Location: Southend, Essex, UK

Will do.

Unread postby narnsmarn » October 4th, 2006, 9:24 am

As soon as I get home from work I'll do that. Thanks for the fast reply. I appreciate it.
narnsmarn
Active Member
 
Posts: 3
Joined: October 4th, 2006, 8:22 am

Unread postby narnsmarn » October 6th, 2006, 7:01 am

After doing a lot more reading on my problem, and coming across a few threads with the same difficulties I arrived at the conclusion the problem was rootkit related and a very serious breech of security. That being said I could not feel safe with removal as I had no idea what changes were made. That being the case I did a complete reformat and clean install of everything .

After numerous hours and a couple of late nights all is good again.

Thank-you ChrisRLG for your prompt offer of assistance.
narnsmarn
Active Member
 
Posts: 3
Joined: October 4th, 2006, 8:22 am

Unread postby ChrisRLG » October 6th, 2006, 8:03 am

do take a look in the public library room here - and particularly at the 'computer safety online' topic.

It has most of what advise we normally give when a victim has been cleaned.

If you had one of the bad trojans with a rootkit - that would probably have been our advise - R&R (Re-format & Restore.)

Thank you for telling us what you have done - lots don't and it is appreciated.
ChrisRLG
Administrator Emeritus
 
Posts: 17759
Joined: December 16th, 2004, 10:04 am
Location: Southend, Essex, UK

Unread postby Nellie2 » November 5th, 2006, 2:39 pm

Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

The help you receive here is free but you can help support this site from this link if you wish:
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted
User avatar
Nellie2
Administrator Emeritus
 
Posts: 8737
Joined: December 16th, 2004, 5:01 pm
Location: UK
Advertisement
Register to Remove


Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 334 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware