had a bit of a run in with some spyware on my pc

at random intervals a file called www.exe appears in my c:\documents and settings\steve buck\ folder. This file then executes (randomly) in a dos prompt style window. If the pc is left unattended for long periods of time, it keeps executing this file over and over again so I end up with a load of windows on the screen. The more that are open the slower the pc gets (obviously) and my network grinds to a halt (in particular, ICS and remote desktop). I suspect the exe is pinging an address over and over.

I've tried deleting the file, i've even locked out my self permissions from executing the file. And it just keeps reappearing and executing.

Ive ran virus scans (Norton 2004), and 4 different spyware apps (microsoft, search & destroy, adaware, adware) and although they pick up a lot of new spyware appearing on my pc (3 - 6 items per day) they never pick up this www.exe file.

I've been through the registry and there's no references to www.exe.

NExt stage is to just rebuild the pc. But before I do, my last cry for help if anyones come across this one or can reccomend a better spyware app than the ones I've tried.

 

boot into safe mode and look in add/remove programs, remove if u see it there

next get a registry cleaner

 

its probably hiding a cpy of itself in a system restore folder or the recycle bin so that it aint detected

do a search on one of the antivirus sites, find the virus in questiona nd follow the manual removal instructions

www.sophos.com

www.symantec.com

www.mcafee.com

 

further to the above two posts, before booting up into safe mode, switch OFF system restore then reboot into safe mode.


Apparently certain files are flagged to windows XP as essential files, and windows will restore them automatically if you delete them.

TBH i dont know how true the above is, it may be myth, but from experience removing stuff like this ive found instances where it was only possible to do it with restore turned off. (in all honesty ive never had that crap be any use anyway. is always off now.)



if you run "hijack this" and post the log it could also help provide clues as to whats on your system too.