Protector.exe driveing McAfee (and Me) crazy.

Yesterday my son was using his computer and came to me complaining that there was a McAfee warning he could not get rid of.

Sure enough the message that c:windows/system32/protector.exe" is trying to access the internet was there. Selecting any of the options presented (ie. block all access) did nothing and the message pops up every 20-30 seconds.

I have updated and run McAfee virus scan and updated the firewall. No good, same message. I have also updated and run zoftspy, no good. Those two aps show the computer as being clean, but this problem persists.

I can find no process by this name in task manager and can locate no program by this name anywhere on the box.

I can find no useful information on this problem via Google and haven't come across a similar problem on this board (I will admit my search hasn't been exhaustive).

Has anyone heard of this in the past, and have you any idea where I should go from here?

Great board by the way. Nice to see y'all helping out folks like me.

We need a hijackthis log for diagnosis.

http://www.malwareremoval.com/forum/viewtopic.php?p=39#39

At the bottom of that post is instructions on where to get HJT etc.
If you have a problem with it - check out the 'nellie2 on the web' link near the top of the forum - she has a very good tutorial.

Please post as a reply to this topic

As soon as I get home from work I'll do that. Thanks for the fast reply. I appreciate it.

After doing a lot more reading on my problem, and coming across a few threads with the same difficulties I arrived at the conclusion the problem was rootkit related and a very serious breech of security. That being said I could not feel safe with removal as I had no idea what changes were made. That being the case I did a complete reformat and clean install of everything .

After numerous hours and a couple of late nights all is good again.

Thank-you ChrisRLG for your prompt offer of assistance.

do take a look in the public library room here - and particularly at the 'computer safety online' topic.

It has most of what advise we normally give when a victim has been cleaned.

If you had one of the bad trojans with a rootkit - that would probably have been our advise - R&R (Re-format & Restore.)

Thank you for telling us what you have done - lots don't and it is appreciated.

Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

The help you receive here is free but you can help support this site from this link if you wish:
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted