Shoutbox

quote:

---

Originally posted by Dane
"Systray.exe", and in some cases, "MediaAccess.exe" and "MediaAccK.exe".  It shuts them down, waits 4 seconds to ensure they are all shut down, then deletes the files and then deletes the startup entries.

---

Erm Dane are sure its Systray.exe.

quote:

---

Originally posted by http://www.liutilities.com/products/wintaskspro/processlibrary/systray/

systray - systray.exe - Process Information

Process File: systray or systray.exe
Process Name: Microsoft System Tray Services

Description:
systray.exe is a background process which displays information such as date and time. This program is important for the stable and secure running of your computer and should not be terminated.

---

Yes, im 100% sure.  It was in the wrong location and wasnt signed by Microsoft .  In fact, running it reinstalled the virus .

Systray.exe is only needed for Win 2K or below, so if it's on Windows XP, then it's gotta be a virus >_>

Anyway, nice job with the removal tool Maybe you could add something that detects if the person has the virus, and if not, instead of saying "The Virus has been successfully removed from your computer", it could say something like "The virus was not found on your system." Not a big deal, but I think it would be a little better

Due to the many different installtypes, I cant detect any one way.

Update 1.00.02:
-Removed "Msn Butterfly" logo due to disputes about it; This release now has a PLAIN QUESTIONMARK!

quote:

---

Originally posted by Dane
-Removed "Msn Butterfly" logo due to disputes about it; This release now has a PLAIN QUESTIONMARK!

---

thank you dane

Could you please make it display a report when it’s done taking the virus out.

I ran it just to make sure I didn’t have the virus and it said the H.AdwareDropper.A has successfully been removed. Now I don't now if I had it or not. If you could show the files and changes it removed after the scan is done it would be better.

Ive ran the removal tool and it is still there.

"Wsup.exe" and "WToolsA.exe",  have been running since i got the virus.

Ive had "MediaAccK.exe" and "MediaAccess.exe" processes running on all my computers for ages without receiving this virus...

edit: I keep getting messages from my firewalls and virus scanners saying that access to the file toolbar[numbhere].exe has been blocked.

Could this be part of the virus?

Hello,

I will release an update to the tool tommorow with more advanced information and clearer messages about what actions the tool performed.  I will also do research on bal's comment.

Thank you.

Update: bal, can you please run your suspicious files through Link Removed - Product Still in Beta, which currently only detects this worm.  I can analyze it then.

Its  a hack tool right?
but its at the picturecentre site how did they do that?

It's not a hack tool. It claims to be it, but it's just a trick to make you download and install it and give it to your friends so they all get infected by the virusses and the adware so the creators earns money with all the ads you see etc.
(Correct me if I'm wrong)