Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My laptop running old WIndows XP is being viciously attacked by sltpfektssd.exe? and others. It appears as a legit pop-up to start an anti-virus program that I have never seen before. Eventually different pop-ups and fake programs start running, so there is a scheduling component. It tries to get on the internet so I have my lap top's wifi turned-off and took it out of my router's setup (reserved IP, allowed mac-addr for the wifi, etc.)

If it is allowed to get started off of a reboot or logon, it will constantly block starting any program with a pop-up that it is infected. So you have to quickly bring up the task manager and keep it open to kill unknown processes and processes with legit names - but are bogus (jupdater.exe, jusched.exe, wmiprvse.exe to name a few.

Does this sound familiar and does anyone have experience in cleaning this up?

I have surfed for some info that has gotten me to the point that I was able to get my Norton to scan, unfortunately, it cannot get its live updates.

share|improve this question
jusched.exe and wmiprvse.exe are actually legitimate programs. – Hello71 Jul 20 '10 at 2:19
@Hello71, depends on their location, some malware can use those names, but the files will be located in the wrong place. – Moab Jul 20 '10 at 3:10
thanks Hello71. I will check the location before any nuking. But it did appear to be part of the problem that had to be killed from the task manager. – mobibob Jul 20 '10 at 4:50

You are infected, try running these 2 scanners one at a time.

MBAM, download, install it, and update it twice using the update tab. Do a quick scan.

SAS, free version

remove any infections the programs find.

If they do not update, just do a scan.

share|improve this answer
I was very disappointed to find out that after using these products that they would not cleanup the viruses found in the scan until I paid the hostage price. Very poor marketing. I already have a virus scan program that I paid a subscription to and it failed to find the trojan horse. This wasted 24 hours of setup, scanning and non-cleaning -- followed by uninstall. – mobibob Aug 11 '10 at 2:18
Sounds like you were not running the actual MBAM or SAS, and instead were duped into running the spyware's scanner. The real MBAM or SAS do not ask for money. – James Watt Aug 11 '10 at 3:28
up vote 0 down vote accepted

AVG Free was able to find and quarantine the malware. There were several trojan horses and if I continued to use Firefox, they would reappear in a matter of hours. I switched back to the native Internet Explorer with AVG Free keeping vigilance over my laptop. I have since disabled Synoptics. The laptop has regained its speed and is virus free.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .