Need help in removing adware
Results 1 to 10 of 10

Thread: Need help in removing adware

  1. #1
    Member
    Join Date
    Nov 2003
    Posts
    58

    Need help in removing adware

    I am running windows XP sp2....
    somehow my PestPetrol detected adware When.U.Save.Now in a file named wc3_install.exe in my temp folder when i autorun my Warcraft3 CD...wc3_install.exe is the autorun file for my warcraft3 CD....i tried to delete the file but it keeps coming back each time I autorun my warcraft3 CD...
    I did a scan with Spybot : Search n Destroy and found no adware and HijackThis can't detect the adware either....interestingly I used the 'file analysis' function in PestPetrol but it says that wc3_install.exe is not a known pest....
    So is this file really infected or is it just a false alarm from PestPetrol...
    And if there is really an adware how could i remove it?
    Any help is kindly appreciated....thx

  2. #2
    Hoopy Frood
    Join Date
    Jun 2004
    Posts
    662
    Is your WC3 copy legit or is it pirated off the internet? If it's legit, then it's probably just a mistake on Pest Patrol's side. Last time I checked, Blizzard didn't bundle Ad-ware with their games.

    - X
    "Personality is only ripe when a man has made the truth his own."

    -- Søren Kierkegaard

  3. #3
    Member
    Join Date
    Nov 2003
    Posts
    58
    Mine is the legal copy.....thx for the answer Xierox : )

  4. #4
    Hoopy Frood
    Join Date
    Jun 2004
    Posts
    662
    You're welcome. Well, if your copy is legal then my gut says that it's just a bad definition in Pest Patrol and probably nothing to worry about. The thing that's weird about it is that there's not one result returned by Google when I search for "wc3_install.exe". Odd. Oh well. Chances are you're fine, I'd say.

    [EDIT] I'm not as knowledgable as others out there, though. Anyone else want to backup or disagree with my thoughts on the subject? Appreciate it![/EDIT]

    - X
    "Personality is only ripe when a man has made the truth his own."

    -- Søren Kierkegaard

  5. #5
    Member
    Join Date
    Nov 2003
    Posts
    58
    oops....its "war3_install.exe" not "wc3_install.exe" sorry...

  6. #6
    Hoopy Frood
    Join Date
    Jun 2004
    Posts
    662
    Originally posted here by spellabc
    oops....its "war3_install.exe" not "wc3_install.exe" sorry...
    Aha. Now that makes a difference. Check this out:
    http://www3.ca.com/securityadvisor/p...x?id=453075520

    I only skimmed it (going to bed), but it's possible that you really are infected. It lists "war3_install.exe" as one of the possible processes that WhenU can run as. Scroll down near the bottom and you'll see it in the "Kill list." Just above the Kill list is the manual removal. Could try that and see what you turn up. Post your results.
    Whether or not you find anything it might be good to post a HijackThis log here for review by a senior. You can get the latest version from here: http://www.spywareinfo.com/~merijn/downloads.html

    - Xierox
    "Personality is only ripe when a man has made the truth his own."

    -- Søren Kierkegaard

  7. #7
    Member
    Join Date
    Nov 2003
    Posts
    58
    did a manual registry check (clean) and a manual search for files listed on your page
    found these files:
    war3_install.exe (deleted)
    cmdlineext02.dll (unregistered n deleted)
    scecomp.old (deleted)
    setup_wm.exe (deleted)

    and 2 suspicious files :
    WAR3_INSTALL.EXE-22A239EF.pf (deleted) c:\windows\prefetch
    WAR3_INSTALL.EXE-25D75D9C.pf (deleted)

    deleted the entire content in my 'temp' and 'temporary internet files' folders

    thx for your help
    rebooting...

  8. #8
    Member
    Join Date
    Nov 2003
    Posts
    58
    Pestpetrol still detected "war3_install.exe" as a pest when i autorun my warcraft3 CD....

  9. #9
    Senior Member
    Join Date
    Feb 2004
    Posts
    202
    Pest Patrol is well known for its false positives. I'm certain this file, running from your temps, is part of your game. Open it with a hex editor or some such & peek through it if you want to be sure, but I wouldn't worry about it.

  10. #10
    Member
    Join Date
    Nov 2003
    Posts
    58
    thx....guess i can live with it

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •