Removing Unwanted, Self-Downloading Programs

[Tokugawapants]

I have an extremely desperate problem on my hands. Yesterday, my buddy was over and led me to a, let's just say, less than wholesome site. Lucky for me, myWindows firewall was not up and I had minimum security settings on my IE browser. I was able to remove a lot of stuff with Ad-Aware (about 360 objects!), Spybot Search and Destroy, and Add/Remove Plus!. However, I still have a bunch of processes that show up on my computer on startup and they totally eat up CPU (my computer is constantly running at 100%). For the sake of being complete, the processes are:

YSlJoqfx.exe (or YS| or YSI, can't really tell the difference)

mvucw.exe

wea1d4c.exe

bewms09.exe

Only two of these processes show up at a time, but manually ending one of them makes another appear. I know it would be helpful to choose "End Process Tree," but I just wanted to know if there was a way to completely remove these from my system. (System Restore doesn't work for some reason ) Thanks.

[TomcaT]

Do a search for the .exe names and note where they are on you HD.

Run Regedit and then navigate this path:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\RUN\

Check to see if the filenames show up there, if they do... delete them

Re-Boot and then delete the files.

Hope this helps..... Cheers.

[Tokugawapants]

Sorry, it didn't work. In regedit I went to:

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\RUN\

and

HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\

and the programs didn't show up. I did a search for the .exe names and they only came up as .pf files in the C:\WINDOWS\Prefetch\ folder. I deleted those just in case and rebooted, but the problem still exists. Thanks anyway.

[TomcaT]

Hmmmm strange one, delete everything in the PREFETCH folder and also have a look at the last post on this thread and try those programs.... other than that I cannot help... sorry. Let us know how you get on.

[plcprogrammer]

I had the same problem. I was on a site looking for POSTERS! We are not safe anywhere.

My first problem was a new slim banner at the bottom of my screen. I don't like things I don't ask for!!! I went to ADD/REMOVE programs. I found the program and tried to remove it. It said I had to download the uninstall program from the web site. Here was my stupid mistake! I downloaded the uninstall program from the web site. Did it uninstall? ELL NO!! Now my computer was walking not running. Walking slow too, I might add. That uninstall program was just another SPY program.

The programs listed at the bottom KILLED this program and its entire family!

The programs I found in Task Manager Processes were:

Dfynt10U.exe

GgumBU.exe

MvuCw.exe

Nfw8fV8C.exe

WtijqA2.exe

I only found one running at a time. When I would END TASK on one, another would start. Each one of them were using up the CPU. I wrote all of them down and declared war!!

I found all of the above files in C:\WINDOWS\SYSTEM32

I rebooted to Safe Mode.

I moved these files to a floppy disk and removed the disk.

I ran CWShredder.exe (***IT FOUND AND SHREDDED***)

I ran Spybot - Search & Destroy (***IT SEARCHED AND DESTROYED***)

I ran Ad-aware 6.0 (***IT FOUND A TON OF SPIES AND EXECUTED THEM***)

I ran Norton Anti-Virus (***NO VIRUS FOUND***)

I rebooted back to Normal Mode

I ran Norton Win Doctor (***IT REMOVED ALL THE LINKS THAT NOW GO NOWHERE***)

Everything seems to be working now.

I decided to find out what those files/programs were for so I searched the internet.

The only one that came up with a result was

MvuCw.exe

I fount one search result and that was this Forum. Only found because of the complaint listed above.

I believe that if any of these files/programs were legit or needed they would be found with a Google Search. That is how I find the purpose of all other files. I just type in the name of the file at google.com

I hope this helps.

I would like to hear any new information on this.

Mike!!!

[Tokugawapants]

Thanks for all your help guys. A quick scan with Norton Antivirus 2004 Proffessional did the trick. Problem solved .