up vote 0 down vote favorite
share [g+] share [fb]

My laptop running old WIndows XP is being viciously attacked by sltpfektssd.exe? and others. It appears as a legit pop-up to start an anti-virus program that I have never seen before. Eventually different pop-ups and fake programs start running, so there is a scheduling component. It tries to get on the internet so I have my lap top's wifi turned-off and took it out of my router's setup (reserved IP, allowed mac-addr for the wifi, etc.)

If it is allowed to get started off of a reboot or logon, it will constantly block starting any program with a pop-up that it is infected. So you have to quickly bring up the task manager and keep it open to kill unknown processes and processes with legit names - but are bogus (jupdater.exe, jusched.exe, wmiprvse.exe to name a few.

Does this sound familiar and does anyone have experience in cleaning this up?

I have surfed for some info that has gotten me to the point that I was able to get my Norton to scan, unfortunately, it cannot get its live updates.

link|improve this question
50% accept rate
jusched.exe and wmiprvse.exe are actually legitimate programs. – Hello71 Jul 20 '10 at 2:19
@Hello71, depends on their location, some malware can use those names, but the files will be located in the wrong place. – Moab Jul 20 '10 at 3:10
thanks Hello71. I will check the location before any nuking. But it did appear to be part of the problem that had to be killed from the task manager. – mobibob Jul 20 '10 at 4:50
feedback

2 Answers

up vote 1 down vote

You are infected, try running these 2 scanners one at a time.

MBAM, download, install it, and update it twice using the update tab. Do a quick scan.

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

SAS, free version

http://www.superantispyware.com/

remove any infections the programs find.

If they do not update, just do a scan.

link|improve this answer
I was very disappointed to find out that after using these products that they would not cleanup the viruses found in the scan until I paid the hostage price. Very poor marketing. I already have a virus scan program that I paid a subscription to and it failed to find the trojan horse. This wasted 24 hours of setup, scanning and non-cleaning -- followed by uninstall. – mobibob Aug 11 '10 at 2:18
1  
Sounds like you were not running the actual MBAM or SAS, and instead were duped into running the spyware's scanner. The real MBAM or SAS do not ask for money. – James Watt Aug 11 '10 at 3:28
feedback
up vote 0 down vote accepted

AVG Free was able to find and quarantine the malware. There were several trojan horses and if I continued to use Firefox, they would reappear in a matter of hours. I switched back to the native Internet Explorer with AVG Free keeping vigilance over my laptop. I have since disabled Synoptics. The laptop has regained its speed and is virus free.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.