system32 virus...
Monday, November 7, 2005 by Ben Fontaine | Discussion: Personal Computing
Mcafee found an infected file called C:\WINDOWS\system32\MSWINDOWS.exe.
My computer has started to run slowly and i need to know what to do to get rid of this. I have run adaware, spybot, and mcafee virusscan in safemode and nothing has worked. Please help me out!!
My computer has started to run slowly and i need to know what to do to get rid of this. I have run adaware, spybot, and mcafee virusscan in safemode and nothing has worked. Please help me out!!
 |
|
Page 1 of 2 | |
|
|---|
caveman23213
Reply #2 Monday, November 7, 2005 12:30 AM
Reply #2 Monday, November 7, 2005 12:30 AM
thanks for the link, but my computer does not have any of those signs of the virus. I am thinking about using system restore to go back to a system checkpoint, is this safe? do you think it would work?
Bichur
Reply #3 Monday, November 7, 2005 12:40 AM
Reply #3 Monday, November 7, 2005 12:40 AM
try the free scans at trendmicro or panda
i'm not too sure that restore points work with viruses
i'm not too sure that restore points work with viruses
kingbee
Reply #4 Monday, November 7, 2005 12:41 AM
Reply #4 Monday, November 7, 2005 12:41 AM
if nothing else, try finding a bootcd (like hiren's) that enables you to work in dos, navigate to it and delete it.
also check for other exe files in your system directories...and review your startup stuff.
also check for other exe files in your system directories...and review your startup stuff.
Bichur
Reply #5 Monday, November 7, 2005 12:41 AM
Reply #5 Monday, November 7, 2005 12:41 AM
prior to doing scans for removal, did you turn off the restore point? virus scanners can't get in there if it's on
scorpio-logic
Reply #6 Monday, November 7, 2005 12:43 AM
Reply #6 Monday, November 7, 2005 12:43 AM
there is any number of things that could be associated to, Ben. Try using the proggy at the end of this here link: Link
it might give you an idea of whether or not it is attached to anything, or if you wanna take steps to remove it. Read through the SysInternals site for other good info on rootkits, spyware and security measures. Happy skinning!
it might give you an idea of whether or not it is attached to anything, or if you wanna take steps to remove it. Read through the SysInternals site for other good info on rootkits, spyware and security measures. Happy skinning!
PoSmedley
Reply #7 Monday, November 7, 2005 12:44 AM
Reply #7 Monday, November 7, 2005 12:44 AM
Be carefule with McAfee. I have had it identify things as virus' that were not. Adaware has a some free plug ins that remove certain virus'. Also, try CWShredder if you can't find any info on the virus, or McAfee identifies it but can't tell you how to remove it.
On a personal note, I have tried Norton, McAfee, and AVG for virus protection. Of the three AVG was the best. Then I tried AVAST (it is free) and AVAST has been by far better than the other ones I have used. You can get the DL on their site and on Cnet. It has found and removed things the others missed. It has some great options (full system scans on boot...and a lot more) that make it convenient and easy to use. But that's just my opinion.
On a personal note, I have tried Norton, McAfee, and AVG for virus protection. Of the three AVG was the best. Then I tried AVAST (it is free) and AVAST has been by far better than the other ones I have used. You can get the DL on their site and on Cnet. It has found and removed things the others missed. It has some great options (full system scans on boot...and a lot more) that make it convenient and easy to use. But that's just my opinion.
Voodoo2678
Reply #8 Monday, November 7, 2005 12:44 AM
Reply #8 Monday, November 7, 2005 12:44 AM
Try AVG Antivirus (free.grisoft.com), it's free, then get Microsoft Antispyware (microsoft.com/downloads), also free, if that doesn't do it, go with ewido antivirus, that one not free. Do not do a system restore, odds are there is spyware associated with that virus and those can embed themselves within your system restore files, not rally getting rid of the problem. Last resort, back up all of your stuff and reload.
Keep me posted.
Keep me posted.
Voodoo2678
Reply #9 Monday, November 7, 2005 12:46 AM
Reply #9 Monday, November 7, 2005 12:46 AM
Spyware doctor is also good at getting rid of infections, but it is not free.
caveman23213
Reply #10 Monday, November 7, 2005 1:16 AM
Reply #10 Monday, November 7, 2005 1:16 AM
yea i saw something saying that system restore actually backs up infected files, so it would not help me. thanks for the suggestions guys.
yrag
Reply #11 Monday, November 7, 2005 1:35 AM
Reply #11 Monday, November 7, 2005 1:35 AM
Just out of curiosity..what happens when you just delete it....????
scorpio-logic
Reply #12 Monday, November 7, 2005 1:44 AM
Reply #12 Monday, November 7, 2005 1:44 AM
no telling, yraq. Do a google on "mswindows.exe", see what you can come up with.
scorpio-logic
Reply #13 Monday, November 7, 2005 1:47 AM
Reply #13 Monday, November 7, 2005 1:47 AM
caveman: AdAware is good. So is Spybot S&D. I run MS AntiSpware, and Spybot's resident at the same time. Then when I get suspicious, I'll run AdAware just to be sure no one else missed it. If I am really suspicious, I'll use rootkitrevealer (see link in #6), and autoruns (also at sysinternals). As far as virus-anti: Avast is the best AND it is FREE.
yrag
Reply #14 Monday, November 7, 2005 1:48 AM
Reply #14 Monday, November 7, 2005 1:48 AM
I don't think it's a virus. I'm guessing Mcafee is giving a false positive and the file is locked by something. If it is, he can just delete it on a boot. http://www.softwarepatch.com/software/moveonboot.html
caveman23213
Reply #15 Monday, November 7, 2005 6:23 AM
Reply #15 Monday, November 7, 2005 6:23 AM
I got avast and ran it, it didnt find anything. I think i will run it again in safemode with system restore disabled.
I just read that boot page, i have never used that before. Would i just use the delete option?
I just read that boot page, i have never used that before. Would i just use the delete option?
PoSmedley
Reply #16 Monday, November 7, 2005 6:55 AM
Common with McAfee. If AVAST isn't picking it up, there is a chance...a chance..it is not a virus. I would google it and see what I could find. I have done this with other things McAfee picked up, ND fter googling, would sometimes find a log or forum...sometimes even on McAfee's own site ..that admits to the error as a bug they are trying to fix.
If all else fails and you are still not satisfied, I would try Hijack This.
Reply #16 Monday, November 7, 2005 6:55 AM
| I'm guessing Mcafee is giving a false positive and the file is locked by something |
Common with McAfee. If AVAST isn't picking it up, there is a chance...a chance..it is not a virus. I would google it and see what I could find. I have done this with other things McAfee picked up, ND fter googling, would sometimes find a log or forum...sometimes even on McAfee's own site ..that admits to the error as a bug they are trying to fix.
If all else fails and you are still not satisfied, I would try Hijack This.
PoSmedley
Reply #18 Monday, November 7, 2005 7:04 AM
Reply #18 Monday, November 7, 2005 7:04 AM
I googled it..MSWINDOWS.exe...and even checked McAfee's own virus library (where it's not even listed) and nothing seems to refer to it as a virus.
Before you delete it, try Hijack This and post the log to one of the HJT forums for analyzing.
Before you delete it, try Hijack This and post the log to one of the HJT forums for analyzing.
Island Dog
Reply #19 Monday, November 7, 2005 7:30 AM
Reply #19 Monday, November 7, 2005 7:30 AM
tjesterb
Reply #20 Monday, November 7, 2005 8:01 AM
Reply #20 Monday, November 7, 2005 8:01 AM
You could also try renaming the file (ie: old_MSWINDOWS.exe) and see what effect that has on your PC rather than deleting a file that may be necessary to some Windows process.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 1 of 2 | |
|
|---|
Reply #1 Monday, November 7, 2005 12:24 AM