Lmfao virus!!!

[NeverBorn]

LOL. I just caught a virus off of the tnt hack and have resorted to my phone, i'm running a system scan right now (mcafee)

it's some sort of antivirus remover adware crap. My desktop is now blue and says: YOUR SYSTEM IS INFECTED!

It is recommended to use spyware removal tool (some more adware) to prevent data loss.


Could i get any help on this? Thanks.

[NeverBorn]

Are you trying to open the Task Manager with CTRL+ALT+DEL?
Try going to [Run...] and typing [taskmgr].

nope, not working :\

[imfuckinglame]

Try [Run...], [cmd], [taskkill /IM winupdate.exe].
Or [taskkill /FIM winupdate.exe] to force-kill the process.

Sorry, [tskill]. Not [taskkill].

[NeverBorn]

Try [Run...], [cmd], [taskkill /IM winupdate.exe].
Or [taskkill /FIM winupdate.exe] to force-kill the process.

Sorry, [tskill]. Not [taskkill].

alright i did tskill /IM winupdate.exe in command prompt. now i have a couple of options.. what should i choose?

[imfuckinglame]

Actually, just try [tskill /V winupdate] and tell me the output.

[NeverBorn]

ouput: endrpocess<748>

[imfuckinglame]

Brilliant. Now [Run...], [msconfig], [Startup] and look for [winupdate].
Uncheck it and look under the [Command] column to see where it's coming from.

[NeverBorn]

all it says is C:/WINDOWS/system...

and i can't see anything else.

[imfuckinglame]

Haha. Grab the little | to the right of the [Command] column title and drag it to the right a little.

[NeverBorn]

oh durrrrr LMAO. system32update.exe

[imfuckinglame]

... If winupdate.exe is located in the folder C:\Windows\System32 then the security rating is 77% dangerous. File size is 786,432 bytes (13% of all occurrence), 1,467,904 bytes, 1,335,808 bytes, 2,188,288 bytes, 1,378,373 bytes, 5,632 bytes, 1,458,176 bytes, 108,271 bytes, 87,040 bytes, 1,335,296 bytes, 104,679 bytes, 1,287,698 bytes, 231,354 bytes, 107,008 bytes, 61,628 bytes. It is not a Windows core file. There is no information about the maker of the file. ... The program has no visible window. It is an unknown file in the Windows folder. winupdate.exe is able to record inputs, monitor applications, hide itself, manipulate other programs. ...

As quoted from here: winupdate.exe Windows process - What is it?

Okay, so you'll have to navigate to the WINDOWS/System32 folder and delete it manually.

[NeverBorn]

alright, i think i found it.. it's called WIN (it's the only one...)

size: 18.0 kb

[imfuckinglame]

Is it an extension-less file or is it an .exe?
We just have to be careful because the System32 folder is pretty important.

[NeverBorn]

MS-DOS application

last updated: 7/12/2003.


finally...25/170,000 files were found infected by MBAM

[imfuckinglame]

Mmm... if it's not a .exe, I'd leave it alone and just let MBAM do some karate-chopping. Then restart your computer and see if you can run the Task Manager. If you can, check to see if winupdate.exe is running again.

[NeverBorn]

restarting right now..