Help Needed..Virus Removal

  • Milesy
  • Born
  • Born
  • No Avatar
  • Joined: May 04, 2004
  • Posts: 4
  • Loc: UK
  • Status: Offline

Post May 4th, 2004, 12:23 pm

Hello all...
Can anyone help me with a problem i have.....
When i boot up, (XP Home edition) i get a file in task manager called msaccess...I did some research and there wasn't much info, all i found was that it might be Klez worm as it overwrites the msaccess file, i use Mcafee virus scan and it finds the file in windows/system32 folder, Mcaffe reads it as a dialer-gen....
So....
I ran a Klez worm detection tool, and nothing.....
Then......
I turned off system restore, rebooted in safe mode, run the virus scan, deleted the msaccess file, but i could not find the reg key in regedit....
I looked in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
But could not find it.....
Anyway i rebooted but the file is still there in task manager, and i keep getting a small popup saying "already running"....

I forgot to add, that i also use and have tried, Adaware,CWShredder, and numerous spyware/trojan/malware removal software....

Can anyone help...?
  • Anonymous
  • Bot
  • No Avatar
  • Joined: 25 Feb 2008
  • Posts: ?
  • Loc: Ozzuland
  • Status: Online

Post May 4th, 2004, 12:23 pm

  • Ragnar78
  • Proficient
  • Proficient
  • No Avatar
  • Joined: Feb 12, 2004
  • Posts: 279
  • Status: Offline

Post May 4th, 2004, 2:06 pm

Try a webscan from norton site...and then download the correct removal tool...
  • Milesy
  • Born
  • Born
  • No Avatar
  • Joined: May 04, 2004
  • Posts: 4
  • Loc: UK
  • Status: Offline

Post May 4th, 2004, 3:03 pm

Tried that just...
found nothing, its really strange why this is happening...
  • Ragnar78
  • Proficient
  • Proficient
  • No Avatar
  • Joined: Feb 12, 2004
  • Posts: 279
  • Status: Offline

Post May 4th, 2004, 3:27 pm

Cause you're using to much P2P i guess...
These things come and go and hide in anyfile type possible...
  • shatter2day
  • Graduate
  • Graduate
  • User avatar
  • Joined: Apr 23, 2004
  • Posts: 179
  • Loc: N.Y.
  • Status: Offline

Post May 4th, 2004, 8:53 pm

just out of curiosity have you tried uninstalling and reinstalling microsoft office? for some reason im getting the feeling that it has to do with your microsoft access program. (Assuming you have microsoft access)
  • Milesy
  • Born
  • Born
  • No Avatar
  • Joined: May 04, 2004
  • Posts: 4
  • Loc: UK
  • Status: Offline

Post May 4th, 2004, 10:06 pm

Sorry forgot to mention that i am not using any office programs..
  • Joyous
  • Newbie
  • Newbie
  • No Avatar
  • Joined: May 05, 2004
  • Posts: 8
  • Status: Offline

Post May 5th, 2004, 10:43 am

Could you take a screenshot of the problem? I'm not sure of exactly what's going wrong with your system..

I don't think it's klez from what it sounds like, but i don't know what's going on, either. If it was klez, you probably wouldn't even notice it.. it generally doesn't affect your system at all, it just sends out random crap email.

If you think it is klez, check your registry for:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wink(insert random garble afterwards (for instance, wink2197213) )


Otherwise, do a printscreen, because i'm not sure what the problem is.. :)
  • bkummer
  • Student
  • Student
  • User avatar
  • Joined: Apr 26, 2004
  • Posts: 69
  • Loc: Butler, Pennsylvania
  • Status: Offline

Post May 5th, 2004, 11:27 am

did you try to go to Mcafee and download a stinger? This has about 40 of the top viruses and removes them without any hassle. Just a suggestion.
  • Milesy
  • Born
  • Born
  • No Avatar
  • Joined: May 04, 2004
  • Posts: 4
  • Loc: UK
  • Status: Offline

Post May 5th, 2004, 11:43 am

Joyous wrote:
Could you take a screenshot of the problem? I'm not sure of exactly what's going wrong with your system..

I don't think it's klez from what it sounds like, but i don't know what's going on, either. If it was klez, you probably wouldn't even notice it.. it generally doesn't affect your system at all, it just sends out random crap email.

If you think it is klez, check your registry for:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Wink(insert random garble afterwards (for instance, wink2197213) )


Otherwise, do a printscreen, because i'm not sure what the problem is.. :)

Don't think its Klez.. no files in that registry folder, the problem is hard to explain, all i can say is as i said in thr first post....i use Mcafee virusscan proffesional, and it finds this file (mssaccess.exe ) as a dialer-gen, a potentially unwanted program...which is running in taskmanager, i can end the process, no problem, however if i leave it running i get a small popup box sayinh already running....i have booted in safe mode and deleted the file, but because i can't find the regkey it returns when i reboot.
If i could find out where it was in the registry, i could boot in safemode, run the virus scan delete the file then delete the registry file.....
  • Joyous
  • Newbie
  • Newbie
  • No Avatar
  • Joined: May 05, 2004
  • Posts: 8
  • Status: Offline

Post May 5th, 2004, 11:57 am

Sounds strange.. but aside from McAfee pointing it out as a dialer-gen, what is it doing to your system? Have you actually noticed anything yet? heh

Msaccess can be abused by stuff such as klez, i'm not sure how Mcaffee works since i've never used it, so maybe that's why it lists it as a potentially dangerous file? Msaccess itself isn't a problematic file..

I don't think you're supposed to be deleting Msaccess unless something is actually wrong with it. :(
  • DuckIT
  • Graduate
  • Graduate
  • User avatar
  • Joined: May 04, 2004
  • Posts: 155
  • Loc: London, UK
  • Status: Offline

Post May 6th, 2004, 6:36 am

This is probably a stupid question but have you looked in Start>Programs>Startup?

Also try running up MSConfig (Start>Run>msconfig.exe) then click startup and see if you can find the file there? (msconfig also checks the startup so you can just use that instead of my first suggestion)

S
  • Frankish
  • Beginner
  • Beginner
  • User avatar
  • Joined: May 15, 2004
  • Posts: 58
  • Status: Offline

Post May 15th, 2004, 4:35 pm

Hello everyone...I was looking for some info on a virus detected as "Dialer-gen" (wzdesk6x[1].exe) and I found your post right here about it....
So I did a fast Mc cafee virus scan and was able to deleted ...but the thing is ...my computer has been running with it for probably 3 days...does anyone know if the virus itself once deleted by mc cafee can still remain in some other file>?

+ since we're in the topic...If you guys know anything about that'd be cool!! :
Adware-Rblast.dll (0006[1].cab) & Adware-netPals (gnsnfnrsz[1].cab)


Thanks again ...
  • ATNO/TW
  • Super Moderator
  • Super Moderator
  • User avatar
  • Joined: May 28, 2003
  • Posts: 23404
  • Loc: Woodbridge VA
  • Status: Offline

Post May 15th, 2004, 4:54 pm

This may provide help.

http://securityresponse.symantec.com/av ... en@mm.html
"There's no place like 127.0.0.1 except for ::1."
Alexandria Networks. Leader in IT consulting for associations/non-profits, and small to medium sized businesses around the northern Virginia and Washington D.C. metro area.
  • Frankish
  • Beginner
  • Beginner
  • User avatar
  • Joined: May 15, 2004
  • Posts: 58
  • Status: Offline

Post May 15th, 2004, 9:46 pm

ATNO/TW wrote:
This may provide help.

http://securityresponse.symantec.com/av ... en@mm.html



allright...thanks for the url....

Post Information

  • Total Posts in this topic: 14 posts
  • Users browsing this forum: No registered users and 117 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
cron
 

© 2011 Unmelted, LLC. Ozzu® is a registered trademark of Unmelted, LLC.