0

My laptop running old WIndows XP is being viciously attacked by sltpfektssd.exe? and others. It appears as a legit pop-up to start an anti-virus program that I have never seen before. Eventually different pop-ups and fake programs start running, so there is a scheduling component. It tries to get on the internet so I have my lap top's wifi turned-off and took it out of my router's setup (reserved IP, allowed mac-addr for the wifi, etc.)

If it is allowed to get started off of a reboot or logon, it will constantly block starting any program with a pop-up that it is infected. So you have to quickly bring up the task manager and keep it open to kill unknown processes and processes with legit names - but are bogus (jupdater.exe, jusched.exe, wmiprvse.exe to name a few.

Does this sound familiar and does anyone have experience in cleaning this up?

I have surfed for some info that has gotten me to the point that I was able to get my Norton to scan, unfortunately, it cannot get its live updates.

3
  • jusched.exe and wmiprvse.exe are actually legitimate programs.
    – Hello71
    Jul 20, 2010 at 2:19
  • @Hello71, depends on their location, some malware can use those names, but the files will be located in the wrong place.
    – Moab
    Jul 20, 2010 at 3:10
  • thanks Hello71. I will check the location before any nuking. But it did appear to be part of the problem that had to be killed from the task manager.
    – mobibob
    Jul 20, 2010 at 4:50

2 Answers 2

1

You are infected, try running these 2 scanners one at a time.

MBAM, download, install it, and update it twice using the update tab. Do a quick scan.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

SAS, free version

http://www.superantispyware.com/

remove any infections the programs find.

If they do not update, just do a scan.

2
  • I was very disappointed to find out that after using these products that they would not cleanup the viruses found in the scan until I paid the hostage price. Very poor marketing. I already have a virus scan program that I paid a subscription to and it failed to find the trojan horse. This wasted 24 hours of setup, scanning and non-cleaning -- followed by uninstall.
    – mobibob
    Aug 11, 2010 at 2:18
  • 1
    Sounds like you were not running the actual MBAM or SAS, and instead were duped into running the spyware's scanner. The real MBAM or SAS do not ask for money.
    – James Watt
    Aug 11, 2010 at 3:28
0

AVG Free was able to find and quarantine the malware. There were several trojan horses and if I continued to use Firefox, they would reappear in a matter of hours. I switched back to the native Internet Explorer with AVG Free keeping vigilance over my laptop. I have since disabled Synoptics. The laptop has regained its speed and is virus free.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .