Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

One of my kids was looking at some voice changing software - AV Voice Changer I think - he says he started to install it but then decided against it.

However, I now think that he did install it but tried to do a manual uninstall rather than using the programs uninistall option or Add/Remove Programs.

Anyway, it left a couple of executables msa.exe in "C:\Windows" and ygh.exe & ygg.exe in "C:\Documents and Settings[user]\Local Settings\Temp".

ygh.exe was trapped by my firewall, but when I checked the logs I saw that msa.exe had been allowed out. It seemed to be connecting to advertisement sites. Both executables were running as processes.

Anyway, I blocked both and then checked online. I couldn't find any information about ygh.exe but msa.exe is identified as a threat on numerous sites. I killed the processes and then removed the executables from their respective locations.

A registry search failed to find msa.exe but ygh.exe turned up in \HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Needless to say it was removed.

So - is there anything else I need to do to clean the PC? I also need to re-educate the kids on not installing software they find on random sites and setup a non-admin account for them.

And please don't say "install Linux" or "buy a MAC" ;)

UPDATE

It looks like I've got a completely compromised OS. I ran Malwarebytes and it threw up some files to delete. I deleted one I was sure of and then had to reboot. On reboot I got a BSOD - "page fault in non paged area".

This happened regardless of the boot mode - "Safe Mode", "Normally", "Last known good configuration" - so after an abortive attempt to use repair mode from the Windows CD (it needs the Administrator password which I thought I knew, but everything I tried was rejected) I decided I would have to do a complete reinstall.

share|improve this question
    
good general virus/malware recommendations at the other superuser faq; it's a must-read: superuser.com/questions/100360/… –  quack quixote Feb 20 '10 at 17:48
    
@~quack - I forgot about that question. –  ChrisF Feb 20 '10 at 17:56
add comment

3 Answers

up vote 1 down vote accepted

i'd give malwarebytes a run - its probably the best malware scanner at the moment, and should root out most things.

share|improve this answer
    
+1 if only for enabling me to spot that my network connection had been fiddled with. –  ChrisF Feb 20 '10 at 17:30
    
i should have mentioned - malwarebytes failing is a sure sign of malware ;p –  Journeyman Geek Feb 20 '10 at 23:36
add comment

I'm not sure about ygh.exe, but numerous sites list msa.exe as a threat. You can never be too safe though.

I'd install an anti-virus solution that has realtime scanning, so it picks most of these things up before they get into the system. If you're willing to put down some money, NOD32 would be my choice. For a free solution, I believe Avira Free has realtime scanning.

You may also be interested in SteadyState (free) or Deep Freeze. With these programs the kids can wreak havoc on the computer and it can be fixed with a simple reboot.

share|improve this answer
    
I've got Avast and Sysgate Personal firewall running - the latter picked up ygh.exe - I suspect my son just allowed msa.exe without thinking. –  ChrisF Feb 20 '10 at 14:44
    
Give your kid his own account, a NON-ADMIN account, and don't let him install any software. You might have to configure Avast and Sysgate so that non-admins can't permit suspicious downloads. –  CarlF Feb 20 '10 at 16:02
    
@CarlF - it's on my list of things to do ;) Up till now I've been closely supervising what they do, but now they're getting older it's time to give them a bit more responsibility. –  ChrisF Feb 20 '10 at 16:48
    
@CarlF - as I've indicated in my question, the computer is now effectively dead. I'm just triple checking I've got the 0.1% of my data that's still on C: before reformatting and reinistalling. –  ChrisF Feb 21 '10 at 10:21
add comment

So it looks like there was something else I needed to do - and that was check the network connection.

I discovered that I couldn't get to malwarebytes.org, so at first I suspected that the software had changed/set up a proxy, but that turned out not be the case.

The next thing to check was the DNS settings on the network connection. Lo and behold they'd been changed to go through an unknown DNS server. Resetting it to "Obtain DNS server address automatically" fixed the problem.

So given that one or the other of these dodgy executables had fiddled with the network settings I'd say its a definite "yes" to the question are they malware.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.