Worrying pop up help

[vRS]

When ever I log into my user name this pop up keep appearing-

Click OK then it just repeats itself a further 3 times then goes away. I have gathered that it might be a virus or Trojan but AVG or Defender don't pick it up during scans, any idea on how to get rid of it?

[D-Fence]

check with msconfig and regedit what is launching......

[vRS]

Did that and came up with nothing, how do I remove the bastard? it keeps trying to access the internet, messes up my email and disrupts a lot of my programs. Ive searched for in in the system32 folder and it wasn't there, AVG r Pest Patrol still cant find it.

[Z102]

Originally Posted by vRS

Did that and came up with nothing, how do I remove the bastard? it keeps trying to access the internet, messes up my email and disrupts a lot of my programs. Ive searched for in in the system32 folder and it wasn't there, AVG r Pest Patrol still cant find it.

Are you scanning in Windows safe mode? Many viruses use techniques to avoid being detected, or even mess up the update process of antiviruses, and often they don't load in safe mode. What I'd do is boot up Windows in safe mode and then do a full scan using AVG and Pest Patrol. If that still doesn't find anything, then as a last resort I'd try booting a boot CD and scan from there. If all that fails, then it's probably not a virus, but something else. Have you installed/uninstalled any software recently? Has Windows crashed unexpectedly? Maybe something has gone wrong with your Windows install.

[der_jackal]

Originally Posted by Z102

If all that fails, then it's probably not a virus, but something else. Has Windows crashed unexpectedly? Maybe something has gone wrong with your Windows install.

Not really, just because a particular type of AV doesn't find it doesn't mean it's not a virus. If the signature files aren't updated, it could miss it. And as good as some of them are, not every one of them is perfect.

That's got all the markings of a virus. If your AV doesn't catch it, you can remove it "by hand" if you want, but it's not an easy process.

Check the registry.

Start >> Run - regedit

CTRL + F and search for nsieezaz

And delete any mentions of that folder location. Then do a Windows file and folder search for it as well and clean out any instances you find of it.

Then prepare to repeat that process for the next series of errors you'll get.

Originally Posted by Z102

Have you installed/uninstalled any software recently?

Yeah, he installed a virus.

[Z102]

Yeah, should have mentioned that. Try a different antivirus, or try an on-line scan. They're not as thorough as a real full scan, but they can detect the most dangerous threats. McAfee Stinger, for instance, saved my ass once with a nasty Bagle infection.

[vRS]

Originally Posted by der_jackal

Not really, just because a particular type of AV doesn't find it doesn't mean it's not a virus. If the signature files aren't updated, it could miss it. And as good as some of them are, not every one of them is perfect.

That's got all the markings of a virus. If your AV doesn't catch it, you can remove it "by hand" if you want, but it's not an easy process.

Check the registry.

Start >> Run - regedit

CTRL + F and search for nsieezaz

And delete any mentions of that folder location. Then do a Windows file and folder search for it as well and clean out any instances you find of it.

Then prepare to repeat that process for the next series of errors you'll get.



Yeah, he installed a virus.

Did the regit things, searched for nsieezaz and found a list of files that all seemed to be viruses associated with it, one way named "ipawns" I can assume that's not a great name, a few were named after programs of songs I had in iTunes which may explain why it had been playing up, one was just called "Stirling" which is where I live ironically.

Deleted them all, Ill now reboot and see if it appears if so shall I just repeat what I just did?

[der_jackal]

Originally Posted by vRS

Did the regit things, searched for nsieezaz and found a list of files that all seemed to be viruses associated with it, one way named "ipawns" I can assume that's not a great name, a few were named after programs of songs I had in iTunes which may explain why it had been playing up, one was just called "Stirling" which is where I live ironically.

Deleted them all, Ill now reboot and see if it appears if so shall I just repeat what I just did?

It's not easy pulling virii out fully by hand. You can keep hunting around for all "partner" references of the main virii file in the registry and in the Windows folders. Next step would be to make sure to check all your Run / Run Once registry keys, and make sure you have your Explorer folder options set to show all file extensions and hidden folders & files. You have to play hunt and peck w/ the all the littel wonky files these things spawn.

But like Z102 said, get a couple of free trials of other AV scanners and run them as well as it's hardish to describe how to remove all the little buggers.


Notice how I haven't even asked what exactly you installed recently that was infected?

[vRS]

Originally Posted by der_jackal

It's not easy pulling virii out fully by hand. You can keep hunting around for all "partner" references of the main virii file in the registry and in the Windows folders. Next step would be to make sure to check all your Run / Run Once registry keys, and make sure you have your Explorer folder options set to show all file extensions and hidden folders & files. You have to play hunt and peck w/ the all the littel wonky files these things spawn.

But like Z102 said, get a couple of free trials of other AV scanners and run them as well as it's hardish to describe how to remove all the little buggers.


Notice how I haven't even asked what exactly you installed recently that was infected?

I think I know what it was anyway, someone send my a virus via MSN 2 weeks ago and that's when the problems happened, currently running Stinger, hope it finds and kills it.

[matt2000]

ah good old viruses. anyone remember that one that made the window slide off the screen? i never actually saw it but it sounded cool, if annoying after a few seconds.

[vRS]

Currently running AVG and Windows Defender in safe mode, 1 and a half hours in and AVG haven't found anything yet.

If this fails would going a system restore to several weeks back help the situation.

[mac-man]

There's a great little program called 'Killbox' which removes running, unwanted applications. A Google search should find it for you, and is totally free. You already know where the executable file (.exe) is located. You can point Killbox towards the location of the threat and remove it manually.

Hope it works out.

[der_jackal]

Originally Posted by vRS

Currently running AVG and Windows Defender in safe mode, 1 and a half hours in and AVG haven't found anything yet.

If this fails would going a system restore to several weeks back help the situation.

Problem there is quite a few virii like to embed themselves in your system restore. And system restore doesn't fully restore the OS to that previous state. It only restores a portion of it (depending greatly on settings and such).

Honest to goodness, download a free trial of eTrust AV or something and run that as well.

[vRS]

Originally Posted by mac-man

There's a great little program called 'Killbox' which removes running, unwanted applications. A Google search should find it for you, and is totally free. You already know where the executable file (.exe) is located. You can point Killbox towards the location of the threat and remove it manually.

Hope it works out.

Killbox found it once and deleted the directory, rebooted and the popups just came up again. Going to try a system restore and if that doesn't work then its time to defrag my hds's, which is the last thing I want to do.

[der_jackal]

defragging your HDs won't do anything. It's merely a method for storing all the bits of files in more "linear" fashion.

You need to clean your system off. Either format it or get a bunch of AV scanners and run them.