Results 1 to 5 of 5

Thread: .Win32.Webmoner.ce VIRUS!!

  1. #1
    Member jon46y's Avatar
    Join Date
    Oct 2002
    Posts
    188

    .Win32.Webmoner.ce VIRUS!!

    I recently did a scan with a-squared and it detected this virus, ".Win32.Webmoner.ce"
    It says it is a HIGH risk trojan and I tred to delete it with a-squared and then I did another scan. It was found in this file :\WINDOWS\system32\dllcache\calc.exe. WHAT SHOULD I Do??. I did a scan with avast and it didn't find abything. I'm using xp.
    Thanks, John

  2. #2
    Stark Raving MOD Midknyte's Avatar
    Join Date
    May 2002
    Location
    Arkham Asylum
    Posts
    22,270
    http://research.sunbelt-software.com...hreatid=145280

    run counterspy or spysweeper and see what you get. both have free trials.

    calc.exe is the windows calculator. some viruses will use system names or infect system files. get rid of it.

  3. #3
    Member jon46y's Avatar
    Join Date
    Oct 2002
    Posts
    188
    I never saw nothing like it. After I thought I deleted it with a-squared and was looking up ways to get rid of it.It spread into my windows files and started changing there names. Found this out when a warning comes up from windows asking for the xp cd because something had corrupted windows operating system files. It wanted to repair the files with the xp cd and I only have the dell cofiguration cd with xp pro on it. I tryed it but the pc needed the xp pro cd. I luckily have been backing up my files lately. I couldn't fing anything on google about removeing the trogan, virus, just that it's a very bad security trogan that does a lot of damage and is serious, so I backed a few more photos up and reinstalled xp from scratch. I have it down to about 4-5 hours now. lucky me. It's up and running again.
    So far so good, been 17 hrs since I reinstalled.
    John....

  4. #4
    Extreme Member! BipolarBill's Avatar
    Join Date
    Oct 2000
    Location
    Norton Noo Joisey
    Posts
    41,528
    If you had a full-time updated Av program running, you would never have gotten it.
    MS MCP, MCSE

  5. #5
    Ultimate Member G's Avatar
    Join Date
    Nov 2000
    Location
    United Kingdom
    Posts
    3,375
    That infection is located in the important Windows File Protection (WFT) backup directory.

    WFP allows the change and copies the file to the default WFP backup directory or (cache folder, Dllcache) by default at %systemroot%\system32\DllCache.

    Download and install the trial version of NOD32: www.eset.com, update the definition files, scan and delete.

    Also install the trail version of CounterSpy: www.sunbelt-software.com

    These are the best-of-the-best, why bother with anything else I do not understand.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •