Ok, my computers been a little weird latley, a little slow and the task manager wouldn't open... I ran adaware and spybot, they didnt find anything more than usual, but i didnt really notice anything else. Then today i get home and theres an illegal operation message up for "msiexec32.exe", which i dont recognize. So i googled it, and its a virus. My main question though is how? It says it infects word and powerpoint files, and i dont even have office installed. I cant remember the last time i opened IE for anything, i uninstalled outlook, my system is up to date (relativly, no SP2), i'm behind a firewall, the only things i've downloaded in the past few days were some ATHF eps that i didnt have and a couple of mp3s and the last program i installed was google earth.

Anywho, i care less about how i got it (still gonne bug the hell out of me though) than how to remove it. Does anyone know where i could get a removal tool or something for this? I dont have norton or mcafee and im pretty broke at the moment. Not that i really feel like i need either since this is the first virus ive gotten in a year of operation...

Secondly, does anything else look out of sorts here? Lotta processes i know, but i have a lot of stuff running... I'm not much of an OS tweaker, anybody got any tips on cutting this list down some? What does all this ati and creative stuff do anyway?

Attached Thumbnails

 

Updating your virus protection would fix it but since you don't use IE or an Anti-virus program you'll just have to live with it. Or you can just reformat your harddrive.

Do you mess with bit torrent stuff at all? Apparently there have been an outbreak of virii on that network recently.

Quote: Originally Posted by GlitterKill Do you mess with bit torrent stuff at all? Apparently there have been an outbreak of virii on that network recently.

I can tell you a few stories of that....its getting bad on BT with Spyware especially on the pr0n section. Mind you it seems like an RIAA shoot at driving people off BT.

I'd also check your e-mail scanner options if you use an outlook/thunderbird ISP address - or one in your network (if you have one ofcourse).

I havnt used BT in weeks, and that was the new knoppix ISO, months before that. No i dont have e-mail protection on since i uninstalled outlook and only use gmail, havnt even checked my hotmail in like a month...

My parents computer is on the same network, they use outlook, but they havnt said anything to me about suspicious emails. I disabled preview and everything for them, and they usually double check with me before opening anythng suspicious. I'll run a scan on theirs later. Is there anyway i could get norton to scan my box from theirs? Or are there any free AV progs? I'm broke as hell, and as i said, its not like it would be worth buying one since this is the only infection i've gotten on this comuter ever.

You could this free online virus scan:
http://housecall.trendmicro.com/

You could also get AVG, or Avast, both are free:
http://www.grisoft.com
http://www.avast.com/

Also, try HijackThis before you do anything:
http://www.majorgeeks.com/download3155.html

Go to Safe Mode and Run all the Ant-Virus programs and Ad-removal programs..........
Kill them befor they Kill You!

Not really pertaining to your problem, but you have entirely too many unneeded processes in your task manager. You can slim that by 8 off the top of my head, probably more.

Quote: Originally Posted by godfoot Not really pertaining to your problem, but you have entirely too many unneeded processes in your task manager. You can slim that by 8 off the top of my head, probably more.

I did mention that in my first post, how? Really all i need open that i know of is trillian, creative system volume, motherboard monitor, sata raid and ati remote wonder, at least thats whats in my system tray. I dont even really know what most of the other stuff does...

check for trojians - one could have been there for along time downloading virus's

I lost a hard disk to virus's because I had to wipe the boot sector but even though I used the right tool the hard disk never worked properly with an os on it. So I changed every bit on the hard disk to 1 but that hevey stress caused the old hard disk to mechanicly die.

All because a stupid trojian downloaded 40+ virus's

As for the bit torrent spyware thing it shouldent happen as bad torrents should be voted off and the recent news about it was manufactured by the RIAA.

Quote: Originally Posted by Cyno01 I did mention that in my first post, how?

First, go into your Real Player properties and turn off the o[ption for automatically starting with Windows to get rid of realsched.exe
jusched.exe is for Java Console I believe, if not, something to do with Sun's java.
ati2evxx.exe is also unnecessary and has 2 instances (I always stop that process after a restart)
spoolsv.exe can go
wdfmgr.exe can go
AtiSched.exe can go (unless this is for tv program listings as I am assuming the ATIRW.exe is for the AIW stuff)
threat.exe looks suspect
viewmgr.exe is for your Viewpoint Media Player plug-in
Not sure about VsTaskMngr.exe
wbload.exe is for Window Blinds
MsPMSPSv.exe is for WMP access for a portable music device and can go if you don't use a portable device.

If you want to do your own research, try this link:

http://www.answersthatwork.com/Taskl...s/tasklist.htm

Here.......the ones underlined in "yellow" don't need to be running and can be diabled by going to RUN and typing MSCONFIG and going to the last tab "startup" and unchecking those items.

The one's underlined in "red" are suspect and would get rid of them.

Those ATI I would allow to run as they are part of the ATI drivers system.

Quote: Originally Posted by Highperf15 Those ATI I would allow to run as they are part of the ATI drivers system.

I have a 9800 Pro and stopping the ati2evxx.exe (both instances) have no effect that I can tell, even when gaming. All these are for is for ATI Hotkeys.

Quote: Originally Posted by godfoot I have a 9800 Pro and stopping the ati2evxx.exe (both instances) have no effect that I can tell, even when gaming. All these are for is for ATI Hotkeys.

Really...........ok.....................it doesn't seem to hurt my performance leavin them

Quote: Originally Posted by Highperf15 Here.......the ones underlined in "yellow" don't need to be running and can be diabled by going to RUN and typing MSCONFIG and going to the last tab "startup" and unchecking those items.

Thanks, thats what i wanted to know. The two underlined in red are there intentionally. Ares is, well, ares, and i dont wanna discuss it here, and threat.exe is this.

Quote: Originally Posted by Cyno01 Thanks, thats what i wanted to know. The two underlined in red are there intentionally. Ares is, well, ares, and i dont wanna discuss it here, and threat.exe is this.

LOL.....Okay.........do those two load on startup??

Quote: Originally Posted by Highperf15 Really...........ok.....................it doesn't seem to hurt my performance leavin them

Here is my source from Answers That Work's Task List Programs reference:

ATI External Event Utility EXE Module. Another background task which gets installed when you install ATI display drivers. Under Windows NT4/2000/XP/2003 the service registers as the “ATI Hotkey Poller” and further investigation shows that it is related to the handling of various ATI Hotkeys which bring up specific ATI utilities. Not only is this facility useless to 99.99% of users, but there is also no documentation anywhere on those ATI hotkeys !! Additionally some of our more inquisitive users have been able to prove that ATI2EVXX can sometimes be an incredible resource hog using up to 85% of CPU utilization !! Older versions of this background task show up as ATIPOLAB in the Task List.
Recommendation :
Disable on the Startups tab of The Ultimate Troubleshooter in Windows 95/98/ME. If you cannot find it on the Startups tab, then read about ATIPTAXX below and disable that task as it often is the task that starts ATI2EVXX. In Windows NT4/2000/XP, go to the Services tab of The Ultimate Troubleshooter, find the ATI Hotkey Poller service and set its Startup Mode to Disabled.

Black Viper has a good guide for core system processes. He explains each of them quite well:
http://dhost.info/kyeu/mirror/blackviper/

For application processes, use common sense / trial and error.

Right now its in safe mode and running the online scanner gorked linked to. Its slow, but its caught a couple of things so far. Should be done in another hour or so..

Quote: Originally Posted by Cyno01 Right now its in safe mode and running the online scanner gorked linked to. Its slow, but its caught a couple of things so far. Should be done in another hour or so..

54 viruses detected, no worm/trojan horse detected. Ooook.... Deleted... time to restart.

EDIT:Hrm, "Task Manager has been disabled by your administrator.", still... goddamnit. I think i disabled the realsched thing, but im not sure, and i disabled the atisched, but now i get a message about it every time i start up my tv.

EDIT:Good news, my powermate knob stopped working again, so i finally looked for new drivers and now its working like its supposed to finally. Still cant get into the task manager, dont feel like screwing with it more right now...