Search
Forum Home | Login
Ben Fontaine
Ben Fontaine
Join Date 11/2005
0

system32 virus...

November 7, 2005 12:19:12 AM from WinCustomize ForumsWinCustomize Forums
Mcafee found an infected file called C:\WINDOWS\system32\MSWINDOWS.exe.
My computer has started to run slowly and i need to know what to do to get rid of this. I have run adaware, spybot, and mcafee virusscan in safemode and nothing has worked. Please help me out!!
Locked Post
Search this post
Advanced Search
Subscription Options
Reason for Karma (Optional)
Successfully updated karma reason!
2 Pages1 2 
Ben Fontaine
WebGizmos
Join Date 09/2003
+735
Reply #1 November 7, 2005 12:24:14 AM
from WinCustomize ForumsWinCustomize Forums
Try a google search for a removal tool
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
caveman23213
Join Date 11/2005
0
Reply #2 November 7, 2005 12:30:05 AM
from WinCustomize ForumsWinCustomize Forums
thanks for the link, but my computer does not have any of those signs of the virus. I am thinking about using system restore to go back to a system checkpoint, is this safe? do you think it would work?
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
Bichur
Join Date 10/2003
+253
Reply #3 November 7, 2005 12:40:11 AM
from WinCustomize ForumsWinCustomize Forums
try the free scans at trendmicro or panda

i'm not too sure that restore points work with viruses
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
kingbee
Join Date 04/2004
+42
Reply #4 November 7, 2005 12:41:15 AM
from JoeUser ForumsJoeUser Forums
if nothing else, try finding a bootcd (like hiren's) that enables you to work in dos, navigate to it and delete it.

also check for other exe files in your system directories...and review your startup stuff.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
Bichur
Join Date 10/2003
+253
Reply #5 November 7, 2005 12:41:59 AM
from WinCustomize ForumsWinCustomize Forums
prior to doing scans for removal, did you turn off the restore point? virus scanners can't get in there if it's on
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
scorpio-logic
Join Date 03/2005
+4
Reply #6 November 7, 2005 12:43:49 AM
from WinCustomize ForumsWinCustomize Forums
there is any number of things that could be associated to, Ben. Try using the proggy at the end of this here link: Link

it might give you an idea of whether or not it is attached to anything, or if you wanna take steps to remove it. Read through the SysInternals site for other good info on rootkits, spyware and security measures. Happy skinning!
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
PoSmedley
Join Date 04/2005
+788
Reply #7 November 7, 2005 12:44:08 AM
from WinCustomize ForumsWinCustomize Forums
Be carefule with McAfee. I have had it identify things as virus' that were not. Adaware has a some free plug ins that remove certain virus'. Also, try CWShredder if you can't find any info on the virus, or McAfee identifies it but can't tell you how to remove it.

On a personal note, I have tried Norton, McAfee, and AVG for virus protection. Of the three AVG was the best. Then I tried AVAST (it is free) and AVAST has been by far better than the other ones I have used. You can get the DL on their site and on Cnet. It has found and removed things the others missed. It has some great options (full system scans on boot...and a lot more) that make it convenient and easy to use. But that's just my opinion.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
Voodoo2678
Join Date 03/2005
0
Reply #8 November 7, 2005 12:44:13 AM
from WinCustomize ForumsWinCustomize Forums
Try AVG Antivirus (free.grisoft.com), it's free, then get Microsoft Antispyware (microsoft.com/downloads), also free, if that doesn't do it, go with ewido antivirus, that one not free. Do not do a system restore, odds are there is spyware associated with that virus and those can embed themselves within your system restore files, not rally getting rid of the problem. Last resort, back up all of your stuff and reload.

Keep me posted.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
Voodoo2678
Join Date 03/2005
0
Reply #9 November 7, 2005 12:46:24 AM
from WinCustomize ForumsWinCustomize Forums
Spyware doctor is also good at getting rid of infections, but it is not free.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
caveman23213
Join Date 11/2005
0
Reply #10 November 7, 2005 1:16:51 AM
from WinCustomize ForumsWinCustomize Forums
yea i saw something saying that system restore actually backs up infected files, so it would not help me. thanks for the suggestions guys.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
yrag
Join Date 08/2001
+393
Reply #11 November 7, 2005 1:35:45 AM
from WinCustomize ForumsWinCustomize Forums
Just out of curiosity..what happens when you just delete it....????
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
scorpio-logic
Join Date 03/2005
+4
Reply #12 November 7, 2005 1:44:28 AM
from WinCustomize ForumsWinCustomize Forums
no telling, yraq. Do a google on "mswindows.exe", see what you can come up with.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
scorpio-logic
Join Date 03/2005
+4
Reply #13 November 7, 2005 1:47:54 AM
from WinCustomize ForumsWinCustomize Forums
caveman: AdAware is good. So is Spybot S&D. I run MS AntiSpware, and Spybot's resident at the same time. Then when I get suspicious, I'll run AdAware just to be sure no one else missed it. If I am really suspicious, I'll use rootkitrevealer (see link in #6), and autoruns (also at sysinternals). As far as virus-anti: Avast is the best AND it is FREE.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
yrag
Join Date 08/2001
+393
Reply #14 November 7, 2005 1:48:45 AM
from WinCustomize ForumsWinCustomize Forums
I don't think it's a virus. I'm guessing Mcafee is giving a false positive and the file is locked by something. If it is, he can just delete it on a boot. http://www.softwarepatch.com/software/moveonboot.html
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
caveman23213
Join Date 11/2005
0
Reply #15 November 7, 2005 6:23:14 AM
from WinCustomize ForumsWinCustomize Forums
I got avast and ran it, it didnt find anything. I think i will run it again in safemode with system restore disabled.

I just read that boot page, i have never used that before. Would i just use the delete option?
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
PoSmedley
Join Date 04/2005
+788
Reply #16 November 7, 2005 6:55:09 AM
from WinCustomize ForumsWinCustomize Forums
I'm guessing Mcafee is giving a false positive and the file is locked by something


Common with McAfee. If AVAST isn't picking it up, there is a chance...a chance..it is not a virus. I would google it and see what I could find. I have done this with other things McAfee picked up, ND fter googling, would sometimes find a log or forum...sometimes even on McAfee's own site ..that admits to the error as a bug they are trying to fix.

If all else fails and you are still not satisfied, I would try Hijack This.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
aimzzz
Join Date 04/2005
0
Reply #17 November 7, 2005 6:56:11 AM
from WinCustomize ForumsWinCustomize Forums
yrag
Thanks for the link
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
PoSmedley
Join Date 04/2005
+788
Reply #18 November 7, 2005 7:04:24 AM
from WinCustomize ForumsWinCustomize Forums
I googled it..MSWINDOWS.exe...and even checked McAfee's own virus library (where it's not even listed) and nothing seems to refer to it as a virus.

Before you delete it, try Hijack This and post the log to one of the HJT forums for analyzing.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
Island Dog
Join Date 06/2003
+1048 sdemployee
Reply #19 November 7, 2005 7:30:57 AM
from WinCustomize ForumsWinCustomize Forums

Use these tools that are on this page.

http://housecall.trendmicro.com/

Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
tjesterb
Join Date 12/2003
0
Reply #20 November 7, 2005 8:01:50 AM
from WinCustomize ForumsWinCustomize Forums
You could also try renaming the file (ie: old_MSWINDOWS.exe) and see what effect that has on your PC rather than deleting a file that may be necessary to some Windows process.
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
caveman23213
Join Date 11/2005
0
Reply #21 November 7, 2005 4:06:46 PM
from WinCustomize ForumsWinCustomize Forums
ok guys, i got my logfile from hijack this. what forum do i post it on?
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
PoSmedley
Join Date 04/2005
+788
Reply #22 November 7, 2005 4:16:42 PM
from WinCustomize ForumsWinCustomize Forums
Try this one....Link

You have to register first (as with most forums)..and it could take a day or two (as with most of these HJT forums) but you will get help.

Since you are unsure of the problem, I would post it under this section >SWI Forums > General Computing Issues > PC Troubleshooting <. A lot of these sites will ignore the log if under the wrong heading. I just went thru what you are going thru and this was the heading I used.

Some people here may know of other forums you can post it on, that they feel are better, and I will admit this is the only one I use, so the choice is yours.
Good Luck!
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
scorpio-logic
Join Date 03/2005
+4
Reply #23 November 7, 2005 4:28:21 PM
from WinCustomize ForumsWinCustomize Forums
just read that boot page, i have never used that before. Would i just use the delete option?


Yes, useful for the index.dat file deletion, too. And not so cimbersome as some other tracks erasing software such as Cyberscrub and the likes.

Also very useful: Link
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
caveman23213
Join Date 11/2005
0
Reply #24 November 7, 2005 7:20:02 PM
from WinCustomize ForumsWinCustomize Forums
Is it safe to delete all of the index.dat files?
Reason for Karma (Optional)
Successfully updated karma reason!
Ben Fontaine
caveman23213
Join Date 11/2005
0
Reply #25 November 7, 2005 11:35:41 PM
from WinCustomize ForumsWinCustomize Forums
I ran an AVAST scan in safemode and it did not find anything. Also, i looked for the file in safemode to rename it, but i didnt see it anywhere.
Reason for Karma (Optional)
Successfully updated karma reason!
2 Pages1 2 
View all recent posts
Mark all posts as read Delete cookies created by the forum Return to Top
Stardock Forums v        Server Load Time:   Page Render Time:

Stardock Magazine | Register | Online Privacy Policy | Terms of Use

Copyright © 2025 Stardock Entertainment and Gas Powered Games. Demigod is a trademark of Stardock. All rights reserved. All other trademarks and copyrights are the properties of their respective owners. Windows, the Windows Vista Start button and Xbox 360 are trademarks of the Microsoft group of companies, and 'Games for Windows' and the Windows Vista Start button logo are used under license from Microsoft. � 2012 Advanced Micro Devices, Inc. All rights reserved. AMD, the AMD Arrow logo and combinations thereof are trademarks of Advanced Micro Devices, Inc.