AT.EXE ... driving me crazy!

[TweakerXP]

My wifes system has this " at.exe " thing going on and I can't seem to get rid of it. I've tried several things from "googleing" it but it keeps coming back. Ran Malwarebytes found a couple trojans but those were taken care of and haven't returned. Scanned several times to make sure. Used HITmanPro, nothing, SAS, nothing ( other than cookies) run my Symantec nothing. All scanners and AV up to date. The system looks clean from running all the scans I can, but yet after a couple hours of sitting idle..... BAM "at.exe" error pops up.

How do I get rid of this thing? I'm starting to get really ticked off at this.:mad: I got my DiskWipe disk out and its ready to go!! My wife says ..NO!

Need some help here.

Thanks guys,

WIN XP Pro w/SP3
1GB mem
120 WD hd
AMD dual core

[Steve R Jones]

When you Goggled you saw that its a valid Windows file....And can maybe be a trojan. It ist start showing up after you added something to the pc?

What does the error message say?

Usually at about the ten hour point on deals like this - I wish like heck I started the nuke and pave six hours earlier;)

[Ol'Tunzafun]

Well, there should be an AT.EXE in System32; where is this one?
What size is it?
Have you deleted all scheduled tasks?
Have you tried running it from the command line with the /? switch?
Search the registry for instances of it.

[TweakerXP]

Well what ever I did to it, the AT.EXE hasn't ccame back...yet. Wifes happy and that's what matters the most.

Steve I can't remember the error, if it comes back I'll write it down.

I'll check the size of it too, Tunz...

If it comes back in the next couple days I'll report back...

Till then... Thanks guys!

[Train]

Over the years I have seen lots of those weird errors disappear and shuting down, wait a minute, then boot back up.

[TweakerXP]

Well after a couple days of screaming cuss words at the computer, the dog and my wife, I found the culprit. SD[1].exe a polymorphic virus. woopie doo....:rolleyes:

After questioning my wife on how this might have happen, she said a girlfriend sent it to her. This girlfriends system was or is infected. My wife got a call from her friend and she said that her emial account was sending out these emails and not to open them. This was a half day later AFTER my wife opened the da@$ thing.

Long story short, I know what it is but I can't seem to locate it. I cut OFF internet access, run AV scan, MalBytes, CClean, Hitman Pro, SAS and they all come up clean. Turn ON the internet access and they pop right up. I have been all through the system networking folder and there isn't anything there that look out of place.

Where else can this thing be hiding?

I'm very near just reformatting but trying to avoid it if I can.

Thanks

WIN XP Pro w/sp3

[Train]

Time to go this route then.
http://discussions.virtualdr.com/showthread.php?t=167915

[Rocketmech]

Ditto... Sysopt forums is not the place to get help with this. As much as we would like to help, your better off in a malware forum where a trained specialist can guide you with the right tools and correctly cleanup the system. Sysopt has a sister site for this and there is a guy who helps out over there that is 'gold' , imo . There are other sites, Bleepingcomputer, Geeks to Go, etc. if you prefer.
Vitual Dr-Intensive Care Unit (http://discussions.virtualdr.com/showthread.php?t=167915) , Sysopt sister site, very thorough, quick to reply.
Geeks to Go (http://www.geekstogo.com/forum/topic/2852-malware-and-spyware-cleaning-guide/) , very thorough , not as quick.
Bleepingcomputer (http://www.bleepingcomputer.com/forums/topic34773.html), very thorough, but can be slow.

The last two offer self help guides and training for the DIY'r.


Something to ponder... there is no anti-virus/malware protection that is 100% except a Backup Image. Get her on a program. ;)

...sorry couldn't resist the dig. :D

[TweakerXP]

Thank you guys for the info...

Wife said to wipe it. She was tired of it. So... a wiping we'll go..... :r

Maybe she'll learn her lesson and stay off facebook and the likes...

Thanks again guys!

I'm going to join up on a couple of these sites...

Image... hmmmmm sounds like a good idea!! :eek: :D

[Train]

Facebook itself is no problem, but the apps they have, are a totally different story.