Shoutbox

Great work Chris, you would of saved a lot of people unnecessary stress .

Thanks Chris4, nice thinking .

I'm not sure if this will help or not, but I have been following this virus for the past 24 hours, my log is as follows:

******** says:
http:// www6. imsector .com/ m.php?m= (email) those ur pics?

^This message appeared around 4:00 PM and 4:30 PM June 8th EST.
After which my computer hasn't been able too run 'Registry Mechanic'.
or certain Internet Exploer web pages (such as norton/windows/microsoft).
It was sent via over MSN Messenger.
wowexec.exe is a possible corrupted file.
retadpu32.exe is a possible corrupted file.

Update: June 8th; 8:50 PM EST

I've deleted ' wowexec.exe' and it keeps "regenerating" its self.
I have ridden 'retapu32.exe' from my task manager, and it seemed to
only allow me to accept the web pages, but my 'Registry Mechanic' still
has no responce when I try too open it; that or it opens and closes
its self without notice.

Update: June 8th; 9:00 PM EST

I am now unable too use the 'Search' function on my computer.
' wowexec.exe' has appeared in my task manager after I had 'deleted' it.


Update: June 8th 9:47 PM EST

cidaemon.exe is a possible corrupt file.
services.exe is a possible corrput file.
crss.exe is a possible corrput file.

Update: June 8th; 10:55 PM EST

'Search' Function comes back online after reboot, everything esle
still applies.

Okay, I had this program but I forget what it's called but my dad never answers the phone. But you can go into safemode and click on start / run / and put in regedit and look for the registry's and delete it and it'll be gone.

I can't even find it in the registry

I reformatted my c drive. it seems that if you hsve two hard drives, it only affects the one it is saved to (the one with the OS?). so upon my brother's advice, I moved my important stuff to the 2nd hard drive, and formatted the c drive, then reinstalled the OS.

strange how I forgot to save my favorites gonna have to find'em all over again

ugh this virus is still bugging me,  if i click a link for the first time,  it will take me to ebay.............................................it's really annoying.........where is it located in the registry?

This lil program works wonders:

Download and restart in safe mode -

http://downloads.malwareremoval.com/MsnVirRem.exe

DL and click the Search and Destroy button.  If you are infected, it will tell you to reboot.

While in Safe Mode Search the registry AND local drive for these files:

retadpu32.exe
netstat.com
taskkill.com
core.cache.dsk
inetget2
ws.exe
ws-1.exe
wr-1.exe
csrss.lnk

Once registry is clean then you need to change your home page back

It took me 2-3 times of cleaning registry and rebooting in safemode to get rid of this one..

i did that,  but i still get the pop up saying there is spyware on my pc plus my homepage is an google advertisement for mozilla firefox.............

oh nvm i'm not done lol