Full scan shows the same result.
Malware Removal Forums
Virus,Virus everywhere,avast,avg all hav failed!!!
52 min read
askey127
How is the machine running?
I don't see any other malware on there. You do still have all the risks of P2P with Limewire.
If you still have infection issues, please read the following, but don't DO anything except tell me.
If you agree that it is running properly, proceed as follows:
-----------------------------------------------------------
Peer to Peer File Sharing
Please note that as long as you're using any form of Peer-to-Peer networking (utorrent, Azureus, DAP, Limewire, etc.) and downloading files from non-documented sources, you can expect infestations of malware to occur.
When you use Peer-to-peer (P2P) programs, you are downloading software from an UNKNOWN source directly onto your computer, bypassing your Firewall and Anti-Virus software. It's hardly surprising that many of the available downloads are being used by malware purveyors as a delivery method for their infections. Further, if your P2P program is not configured correctly you may be sharing more files than you realize. See here : http://www.infoworld.com/article/07/09/06/Seattle-man-arrested-for-p-to-p-ID-theft_1.html
Even if you have one of the SAFE P2P programs, the practice of file-sharing is very UNSAFE for the health of your PC.
You may decide to continue P2P sharing, but keep in mind that this practice may be the source of major PC infections.
Better ask yourself if you and your system CD are REALLY ready to reformat your Hard Drive and Re-install Windows.
The risks of using P2P programs are described here in this Sourceforge webpage and in this Information Week article.
Some malware help forums are now refusing to help those who show up with infections from P2P usage.
I think you should stop using and Uninstall Limewire , but it's your decision.
-----------------------------------------------------------
This is the Issue with infections in relation to PunkBuster:
Your computer has installed gaming tools. Some of these, like Punkbuster, use spyware techniques to engage in the anti-piracy battle.
In the process, they take control of much of your PC, and they actually meet the definition of spyware/malware.
They are sometimes designed to prevent orderly removal or modification.
It is not likely that your computer could be cleaned without breaking or removing some of these programs, and this would result in not being able to play the associated games, or worse.
Since we are dedicated to causing No Harm, we won't normally work on machines with this type of program installed.
If you want to continue using the machine in this way, you should consider using imaging software like Norton Ghost or Acronis, or Terabyte Image, which can put your entire C: drive back into an earlier state whenever the infections or malfunctions get too severe.
-----------------------------------------------------------
The above procedure will :
-----------------------------------------------------------
Run CCleaner. Don't use the Registry tab.
-----------------------------------------------------------
Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs. Available from http://www.javacoolsoftware.com/spywareblaster.html
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.
-----------------------------------------------------------
Install WinPatrol - Download and Install the Free WinPatrol, and view Instructions here: http://www.winpatrol.com/winpatrol.html
- WinPatrol is an active program that drops a "Scotty Dog" icon into the system tray (right click to check/change status), allows you to monitor/edit startups, services, Browser helpers, and prompts for permission if any program tries to change your system. The inexpensive PLUS version is worth it, to give you extra details about the files and processes on your system, and provide incoming protections. You can upgrade from the Free to the PLUS version anytime.
-----------------------------------------------------------
askey127
I don't see any other malware on there. You do still have all the risks of P2P with Limewire.
If you still have infection issues, please read the following, but don't DO anything except tell me.
If you agree that it is running properly, proceed as follows:
-----------------------------------------------------------
Peer to Peer File Sharing
Please note that as long as you're using any form of Peer-to-Peer networking (utorrent, Azureus, DAP, Limewire, etc.) and downloading files from non-documented sources, you can expect infestations of malware to occur.
When you use Peer-to-peer (P2P) programs, you are downloading software from an UNKNOWN source directly onto your computer, bypassing your Firewall and Anti-Virus software. It's hardly surprising that many of the available downloads are being used by malware purveyors as a delivery method for their infections. Further, if your P2P program is not configured correctly you may be sharing more files than you realize. See here : http://www.infoworld.com/article/07/09/06/Seattle-man-arrested-for-p-to-p-ID-theft_1.html
Even if you have one of the SAFE P2P programs, the practice of file-sharing is very UNSAFE for the health of your PC.
You may decide to continue P2P sharing, but keep in mind that this practice may be the source of major PC infections.
Better ask yourself if you and your system CD are REALLY ready to reformat your Hard Drive and Re-install Windows.
The risks of using P2P programs are described here in this Sourceforge webpage and in this Information Week article.
Some malware help forums are now refusing to help those who show up with infections from P2P usage.
I think you should stop using and Uninstall Limewire , but it's your decision.
-----------------------------------------------------------
This is the Issue with infections in relation to PunkBuster:
Your computer has installed gaming tools. Some of these, like Punkbuster, use spyware techniques to engage in the anti-piracy battle.
In the process, they take control of much of your PC, and they actually meet the definition of spyware/malware.
They are sometimes designed to prevent orderly removal or modification.
It is not likely that your computer could be cleaned without breaking or removing some of these programs, and this would result in not being able to play the associated games, or worse.
Since we are dedicated to causing No Harm, we won't normally work on machines with this type of program installed.
If you want to continue using the machine in this way, you should consider using imaging software like Norton Ghost or Acronis, or Terabyte Image, which can put your entire C: drive back into an earlier state whenever the infections or malfunctions get too severe.
-----------------------------------------------------------
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the Combofix and the /u
- When shown the disclaimer, Select "2"
The above procedure will :
- Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\\Deckard folder, if present
- The C:_OtMoveIt folder, if present
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Set a new, clean Restore Point.
-----------------------------------------------------------
Run CCleaner. Don't use the Registry tab.
-----------------------------------------------------------
Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites to your Internet Explorer settings that will protect you from accidentally running or downloading known malicious programs. Available from http://www.javacoolsoftware.com/spywareblaster.html
After the installation, click Download Latest Protection Updates. When it finishes, click Enable All Protection.
-----------------------------------------------------------
Install WinPatrol - Download and Install the Free WinPatrol, and view Instructions here: http://www.winpatrol.com/winpatrol.html
- WinPatrol is an active program that drops a "Scotty Dog" icon into the system tray (right click to check/change status), allows you to monitor/edit startups, services, Browser helpers, and prompts for permission if any program tries to change your system. The inexpensive PLUS version is worth it, to give you extra details about the files and processes on your system, and provide incoming protections. You can upgrade from the Free to the PLUS version anytime.
-----------------------------------------------------------
askey127
Apparently a scheduled task was created without my permission,is that something to be worried about??
askey127
See if you can open that .job file in C:\Windows\Tasks\ with Notepad.
If it's plain text, it may say what it's for, or what the task is.
Post it if it's text and not too large.
check that none of these exist:
D:\WINDOWS\system32\winsys2.exe
D:\WINDOWS\system32\5kG8s0W0.exe <== we never deleted this, but it could be there
D:\WINDOWS\system32\5kG8s0W0.exe.a_a
D:\WINDOWS\system32\0alaS41F.exe.a_a
D:\WINDOWS\system32\0alaS41F.exe
If it's plain text, it may say what it's for, or what the task is.
Post it if it's text and not too large.
check that none of these exist:
D:\WINDOWS\system32\winsys2.exe
D:\WINDOWS\system32\5kG8s0W0.exe <== we never deleted this, but it could be there
D:\WINDOWS\system32\5kG8s0W0.exe.a_a
D:\WINDOWS\system32\0alaS41F.exe.a_a
D:\WINDOWS\system32\0alaS41F.exe
That 0alaS41F.exe existed in d scheduled tasks and i deleted it by winpatrol.
edit - winsys2 exists too.did'nt delete,should i??
edit - winsys2 exists too.did'nt delete,should i??
askey127
Winpatrol will have deleted the job file in C:\windows\tasks\ folder, but not the files named
winsys2.exe and 0alaS41F.exe
Do you know how to search and find those files, and delete them using My Computer?
If so please do it.
If not, let me know, and we will find and remove them with some tools. They need to go.
winsys2.exe and 0alaS41F.exe
Do you know how to search and find those files, and delete them using My Computer?
If so please do it.
If not, let me know, and we will find and remove them with some tools. They need to go.
sorry for late reply,my pc is not working,using laptop,btw i hav deleted them,will post in dis thread again if something goes wrong.
askey127
sidk,