Need help in removing adware

I am running windows XP sp2....
somehow my PestPetrol detected adware When.U.Save.Now in a file named wc3_install.exe in my temp folder when i autorun my Warcraft3 CD...wc3_install.exe is the autorun file for my warcraft3 CD....i tried to delete the file but it keeps coming back each time I autorun my warcraft3 CD...
I did a scan with Spybot : Search n Destroy and found no adware and HijackThis can't detect the adware either....interestingly I used the 'file analysis' function in PestPetrol but it says that wc3_install.exe is not a known pest....
So is this file really infected or is it just a false alarm from PestPetrol...
And if there is really an adware how could i remove it?
Any help is kindly appreciated....thx

Is your WC3 copy legit or is it pirated off the internet? If it's legit, then it's probably just a mistake on Pest Patrol's side. Last time I checked, Blizzard didn't bundle Ad-ware with their games. :p

- X

Mine is the legal copy.....thx for the answer Xierox : )

You're welcome. Well, if your copy is legal then my gut says that it's just a bad definition in Pest Patrol and probably nothing to worry about. The thing that's weird about it is that there's not one result returned by Google when I search for "wc3_install.exe". Odd. Oh well. Chances are you're fine, I'd say.

[EDIT] I'm not as knowledgable as others out there, though. Anyone else want to backup or disagree with my thoughts on the subject? Appreciate it![/EDIT]

- X

oops....its "war3_install.exe" not "wc3_install.exe" sorry...

Quote:

---

Originally posted here by spellabc
oops....its "war3_install.exe" not "wc3_install.exe" sorry...

---

Aha. Now that makes a difference. Check this out:
http://www3.ca.com/securityadvisor/p...x?id=453075520

I only skimmed it (going to bed), but it's possible that you really are infected. It lists "war3_install.exe" as one of the possible processes that WhenU can run as. Scroll down near the bottom and you'll see it in the "Kill list." Just above the Kill list is the manual removal. Could try that and see what you turn up. Post your results.
Whether or not you find anything it might be good to post a HijackThis log here for review by a senior. You can get the latest version from here: http://www.spywareinfo.com/~merijn/downloads.html

- Xierox

did a manual registry check (clean) and a manual search for files listed on your page
found these files:
war3_install.exe (deleted)
cmdlineext02.dll (unregistered n deleted)
scecomp.old (deleted)
setup_wm.exe (deleted)

and 2 suspicious files :
WAR3_INSTALL.EXE-22A239EF.pf (deleted) c:\windows\prefetch
WAR3_INSTALL.EXE-25D75D9C.pf (deleted)

deleted the entire content in my 'temp' and 'temporary internet files' folders

thx for your help
rebooting...

Pestpetrol still detected "war3_install.exe" as a pest when i autorun my warcraft3 CD....

Pest Patrol is well known for its false positives. I'm certain this file, running from your temps, is part of your game. Open it with a hex editor or some such & peek through it if you want to be sure, but I wouldn't worry about it.

thx....guess i can live with it