Virus/Trojan help needed......

Ray · External Since: Feb 18, 2007 Posts: 5

I have found in C\windows\temp numerous "exe" programs that all start
with "winxxxxx" the "x's" being a jumble of letters,such as
"winffgty" and "winsertf" and so on..usually 20 or more of these
little programs show up.

I delete them and yet after surfing the internet they are back.

My Zone Alarm catches them trying to access the internet.

Can anybody tell me what these are and how to rid my PC of them????

Thank You..

Ray
I don't "Suffer" from Insanity..I rather enjoy it!

CATTS
http://members.tripod.com/~thewebster/catts.html

WHY SO BLUE,PANDA BEAR?
http://www.serindaswan.com

pcbutts1 · External Since: Dec 31, 2006 Posts: 98

You get it from the spam malware infected pop ups on your own website.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

"Ray" <elderone.DeleteThis@hotmail.com> wrote in message
news:k9pht2lonn2gc3shunt9heceq9v5bhmjuq@4ax.com...
>
> I have found in C\windows\temp numerous "exe" programs that all start
> with "winxxxxx" the "x's" being a jumble of letters,such as
> "winffgty" and "winsertf" and so on..usually 20 or more of these
> little programs show up.
>
> I delete them and yet after surfing the internet they are back.
>
> My Zone Alarm catches them trying to access the internet.
>
> Can anybody tell me what these are and how to rid my PC of them????
>
> Thank You..
>
> Ray
> I don't "Suffer" from Insanity..I rather enjoy it!
>
> CATTS
> http://members.tripod.com/~thewebster/catts.html
>
> WHY SO BLUE,PANDA BEAR?
> http://www.serindaswan.com

David H. Lipman · External Since: Jul 04, 2003 Posts: 2116

From: "Ray" <elderone.RemoveThis@hotmail.com>

|
| I have found in C\windows\temp numerous "exe" programs that all start
| with "winxxxxx" the "x's" being a jumble of letters,such as
| "winffgty" and "winsertf" and so on..usually 20 or more of these
| little programs show up.
|
| I delete them and yet after surfing the internet they are back.
|
| My Zone Alarm catches them trying to access the internet.
|
| Can anybody tell me what these are and how to rid my PC of them????
|
| Thank You..
|

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm

* * * Please report back your results * * *

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Ray · External Since: Feb 18, 2007 Posts: 5

On Sun, 18 Feb 2007 16:20:26 -0800, "pcbutts1"
<pcbutts1.TakeThisOut@leythosthestalker.com> wrote:

>You get it from the spam malware infected pop ups on your own website.

Could you explain further? I delete these "exe" programs from "temp"
and they return without my ever having accessed my own website,which
is on "free" website provider (Tripod and Geocities) I have had my
websites for over 5 years without this problem before...

How do I get rid of them??

Thanks,
Ray
I don't "Suffer" from Insanity..I rather enjoy it!

CATTS
http://members.tripod.com/~thewebster/catts.html

WHY SO BLUE,PANDA BEAR?
http://www.serindaswan.com

pcbutts1 · External Since: Dec 31, 2006 Posts: 98

Download Hijackthis, run it, save a copy of the log file and paste here so I
can see it. Your system is infected and I need to with what.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

"Ray" <elderone.TakeThisOut@hotmail.com> wrote in message
news:ov0it29qpluf59i9cfcg0sa50jafc8oamt@4ax.com...
> On Sun, 18 Feb 2007 16:20:26 -0800, "pcbutts1"
> <pcbutts1.TakeThisOut@leythosthestalker.com> wrote:
>
>>You get it from the spam malware infected pop ups on your own website.
>
>
> Could you explain further? I delete these "exe" programs from "temp"
> and they return without my ever having accessed my own website,which
> is on "free" website provider (Tripod and Geocities) I have had my
> websites for over 5 years without this problem before...
>
> How do I get rid of them??
>
> Thanks,
> Ray
> I don't "Suffer" from Insanity..I rather enjoy it!
>
> CATTS
> http://members.tripod.com/~thewebster/catts.html
>
> WHY SO BLUE,PANDA BEAR?
> http://www.serindaswan.com

Ray · External Since: Feb 18, 2007 Posts: 5

I have run Hijack and have found nothing. I have run Ad-Aware and it
finds nothing except cookies. I have looked through the registry under
the "run" captions and found nothing.

I have opened these programs in wordpad but cannot understand any of
the gibberish.

One did mention a website url and I checked it out and it was
suspended by the ISP....

www.kukutrustnet7.info/alpha_us/sb148.html

I just need help in identifying what this is..and any advice on where
to look and what to remove.

Anybody else have this problem or seen it before...??

Thanks,
Ray

On Sun, 18 Feb 2007 23:57:49 GMT, Ray <elderone DeleteThis @hotmail.com> wrote:

>
>I have found in C\windows\temp numerous "exe" programs that all start
>with "winxxxxx" the "x's" being a jumble of letters,such as
>"winffgty" and "winsertf" and so on..usually 20 or more of these
>little programs show up.
>
>I delete them and yet after surfing the internet they are back.
>
>My Zone Alarm catches them trying to access the internet.
>
>Can anybody tell me what these are and how to rid my PC of them????
>
>Thank You..
>
>Ray
>I don't "Suffer" from Insanity..I rather enjoy it!
>
>CATTS
>http://members.tripod.com/~thewebster/catts.html
>
>WHY SO BLUE,PANDA BEAR?
>http://www.serindaswan.com

I don't "Suffer" from Insanity..I rather enjoy it!

CATTS
http://members.tripod.com/~thewebster/catts.html

WHY SO BLUE,PANDA BEAR?
http://www.serindaswan.com

pcbutts1 · External Since: Dec 31, 2006 Posts: 98

Are you a HJT expert? if not then I need to see the hjt log.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

"Ray" <elderone.TakeThisOut@hotmail.com> wrote in message
news:jegmt2lorecuqdg1htk7k9r0sab73boapk@4ax.com...
>
> I have run Hijack and have found nothing. I have run Ad-Aware and it
> finds nothing except cookies. I have looked through the registry under
> the "run" captions and found nothing.
>
> I have opened these programs in wordpad but cannot understand any of
> the gibberish.
>
> One did mention a website url and I checked it out and it was
> suspended by the ISP....
>
> www.kukutrustnet7.info/alpha_us/sb148.html
>
>
> I just need help in identifying what this is..and any advice on where
> to look and what to remove.
>
> Anybody else have this problem or seen it before...??
>
> Thanks,
> Ray
>
>
>
>
>
>
>
>
>
>
> On Sun, 18 Feb 2007 23:57:49 GMT, Ray <elderone.TakeThisOut@hotmail.com> wrote:
>
>>
>>I have found in C\windows\temp numerous "exe" programs that all start
>>with "winxxxxx" the "x's" being a jumble of letters,such as
>>"winffgty" and "winsertf" and so on..usually 20 or more of these
>>little programs show up.
>>
>>I delete them and yet after surfing the internet they are back.
>>
>>My Zone Alarm catches them trying to access the internet.
>>
>>Can anybody tell me what these are and how to rid my PC of them????
>>
>>Thank You..
>>
>>Ray
>>I don't "Suffer" from Insanity..I rather enjoy it!
>>
>>CATTS
>>http://members.tripod.com/~thewebster/catts.html
>>
>>WHY SO BLUE,PANDA BEAR?
>>http://www.serindaswan.com
>
> I don't "Suffer" from Insanity..I rather enjoy it!
>
> CATTS
> http://members.tripod.com/~thewebster/catts.html
>
> WHY SO BLUE,PANDA BEAR?
> http://www.serindaswan.com

K. L. Agey · External Since: Feb 20, 2007 Posts: 2

Ray wrote:

> I have run Hijack and have found nothing. I have run Ad-Aware and it
> finds nothing except cookies. I have looked through the registry under
> the "run" captions and found nothing.
>
> I have opened these programs in wordpad but cannot understand any of
> the gibberish.
>
> One did mention a website url and I checked it out and it was
> suspended by the ISP....
>
> www.kukutrustnet7.info/alpha_us/sb148.html
>
> I just need help in identifying what this is..and any advice on where
> to look and what to remove.
>
> Anybody else have this problem or seen it before...??
>
> Thanks,
> Ray
>

Again I ask that you please ignore Butts.

It has been posted numerous times that posting 'Hi Jack This' logs in this
news group is not allowed.

Butts is no 'Hi Jack This' analyst and the software in insufficient to help
you with your problem. That is why there are specialty forums with those
that have gone through a malware removal course and have peer reviews on
how they help the infected user get clean.

Butts is not such a person and is shunned by the anti malware community as
a rogue, thief, plagiarist, liar, etc, etc...

Suggested places to go to where you can post a 'Hi Jack This' log and get
professional assistance

http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html

http://castlecops.com/forum67.html
http://www.bleepingcomputer.com/forums/forum22.html
http://www.atribune.org/forums/index.php?showforum=9
http://forums.subratam.org/index.php?showforum=7
http://forums.tomcoyote.org/index.php?showforum=27

BTW you should run Lipman's Multi_AV if you haven't done so yet.

pcbutts1 · External Since: Dec 31, 2006 Posts: 98

I'm an admin in one of those forums guess which one.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

"K. L. Agey" <kerri-lynn.DeleteThis@ntlworld.REMOVEME.com> wrote in message
news:45DB98FF.A5578FDE@ntlworld.REMOVEME.com...
>
>
> Ray wrote:
>
>> I have run Hijack and have found nothing. I have run Ad-Aware and it
>> finds nothing except cookies. I have looked through the registry under
>> the "run" captions and found nothing.
>>
>> I have opened these programs in wordpad but cannot understand any of
>> the gibberish.
>>
>> One did mention a website url and I checked it out and it was
>> suspended by the ISP....
>>
>> www.kukutrustnet7.info/alpha_us/sb148.html
>>
>> I just need help in identifying what this is..and any advice on where
>> to look and what to remove.
>>
>> Anybody else have this problem or seen it before...??
>>
>> Thanks,
>> Ray
>>
>
> Again I ask that you please ignore Butts.
>
> It has been posted numerous times that posting 'Hi Jack This' logs in this
> news group is not allowed.
>
> Butts is no 'Hi Jack This' analyst and the software in insufficient to
> help
> you with your problem. That is why there are specialty forums with those
> that have gone through a malware removal course and have peer reviews on
> how they help the infected user get clean.
>
> Butts is not such a person and is shunned by the anti malware community as
> a rogue, thief, plagiarist, liar, etc, etc...
>
> Suggested places to go to where you can post a 'Hi Jack This' log and get
> professional assistance
>
> http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
>
> http://castlecops.com/forum67.html
> http://www.bleepingcomputer.com/forums/forum22.html
> http://www.atribune.org/forums/index.php?showforum=9
> http://forums.subratam.org/index.php?showforum=7
> http://forums.tomcoyote.org/index.php?showforum=27
>
> BTW you should run Lipman's Multi_AV if you haven't done so yet.
>
>

kurt wismer · External Since: Jul 04, 2003 Posts: 1496

pcbutts1 wrote:
> I'm an admin in one of those forums guess which one.

i'm guessing it's one of the ones where hjt logs are actually
welcomed... unlike here...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

K. L. Agey · External Since: Feb 20, 2007 Posts: 2

pcbutts1 wrote:

> I'm an admin in one of those forums guess which one.
>

You are neither a member or an administrator in any of those forums.

Christopher Butts you are a consummate liar. Only garbage spews from
your mouth and
fingertips.

The accident you were in caused you brain damage. You no longer know
right from
wrong or truth from lie.

You are a LIAR BUTTS

Bow down and repent to your savior Jesus Christ and then see a doctor as
you are not
well.

David H. Lipman · External Since: Jul 04, 2003 Posts: 2116

From: "Ray" <elderone RemoveThis @hotmail.com>

|
| I have run Hijack and have found nothing. I have run Ad-Aware and it
| finds nothing except cookies. I have looked through the registry under
| the "run" captions and found nothing.
|
| I have opened these programs in wordpad but cannot understand any of
| the gibberish.
|
| One did mention a website url and I checked it out and it was
| suspended by the ISP....
|
| www.kukutrustnet7.info/alpha_us/sb148.html
|
| I just need help in identifying what this is..and any advice on where
| to look and what to remove.
|
| Anybody else have this problem or seen it before...??
|
| Thanks,
| Ray
|

Please run the Multi AV Scanning Tool as I suggested.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Ray · External Since: Feb 18, 2007 Posts: 5

On Tue, 20 Feb 2007 16:31:08 -0800, "pcbutts1"
<pcbutts1 RemoveThis @leythosthestalker.com> wrote:

>Are you a HJT expert? if not then I need to see the hjt log.

No..but I do know how to use the Hijack This Forums....
I don't "Suffer" from Insanity..I rather enjoy it!

CATTS
http://members.tripod.com/~thewebster/catts.html

WHY SO BLUE,PANDA BEAR?
http://www.serindaswan.com

pcbutts1 · External Since: Dec 31, 2006 Posts: 98

My offer of help still stands unless you don't want it.

--

Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
The list grows. Leythos the stalker http://www.leythosthestalker.com, David
H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell

"Ray" <elderone RemoveThis @hotmail.com> wrote in message
news:u1nnt2ljqdni8123ln7vfm99a6m8n8e57k@4ax.com...
> On Tue, 20 Feb 2007 16:31:08 -0800, "pcbutts1"
> <pcbutts1 RemoveThis @leythosthestalker.com> wrote:
>
>>Are you a HJT expert? if not then I need to see the hjt log.
>
>
> No..but I do know how to use the Hijack This Forums....
> I don't "Suffer" from Insanity..I rather enjoy it!
>
> CATTS
> http://members.tripod.com/~thewebster/catts.html
>
> WHY SO BLUE,PANDA BEAR?
> http://www.serindaswan.com

Ray · External Since: Feb 18, 2007 Posts: 5

On Wed, 21 Feb 2007 04:12:55 -0800, "pcbutts1"
<pcbutts1.DeleteThis@leythosthestalker.com> wrote:

>My offer of help still stands unless you don't want it.

Indeed I do...but I have been using HijackThis,Ad-Aware,and Spybot for
some time now and am fully aware of how to use them. I have already
posted the Log in Forums for Hijack and we find nothing out of the
ordinary. My problem is beyond them and my ability.

I have investigated further and find that what I have is a variation
of "Trojan.WMD" which has over 315 variations. It is rather new.

I have also found software that I intend to download that says it will
remove all the variations I might have.

I will report if successful in case anybody else should run into this
Trojan.

Thanks to all for trying to help...

Ray
I don't "Suffer" from Insanity..I rather enjoy it!

CATTS
http://members.tripod.com/~thewebster/catts.html

WHY SO BLUE,PANDA BEAR?
http://www.serindaswan.com

ryno66 · Joined: Oct 31, 2006 Posts: 2

I am experiencing the exact same problem. Was an actual resolution ever found?