-
May 24th, 2005, 08:57 AM
#1
Member
Need help in removing adware
I am running windows XP sp2....
somehow my PestPetrol detected adware When.U.Save.Now in a file named wc3_install.exe in my temp folder when i autorun my Warcraft3 CD...wc3_install.exe is the autorun file for my warcraft3 CD....i tried to delete the file but it keeps coming back each time I autorun my warcraft3 CD...
I did a scan with Spybot : Search n Destroy and found no adware and HijackThis can't detect the adware either....interestingly I used the 'file analysis' function in PestPetrol but it says that wc3_install.exe is not a known pest....
So is this file really infected or is it just a false alarm from PestPetrol...
And if there is really an adware how could i remove it?
Any help is kindly appreciated....thx
-
May 24th, 2005, 09:02 AM
#2
Is your WC3 copy legit or is it pirated off the internet? If it's legit, then it's probably just a mistake on Pest Patrol's side. Last time I checked, Blizzard didn't bundle Ad-ware with their games.
- X
"Personality is only ripe when a man has made the truth his own."
-- Søren Kierkegaard
-
May 24th, 2005, 09:06 AM
#3
Member
Mine is the legal copy.....thx for the answer Xierox : )
-
May 24th, 2005, 09:11 AM
#4
You're welcome. Well, if your copy is legal then my gut says that it's just a bad definition in Pest Patrol and probably nothing to worry about. The thing that's weird about it is that there's not one result returned by Google when I search for "wc3_install.exe". Odd. Oh well. Chances are you're fine, I'd say.
[EDIT] I'm not as knowledgable as others out there, though. Anyone else want to backup or disagree with my thoughts on the subject? Appreciate it![/EDIT]
- X
"Personality is only ripe when a man has made the truth his own."
-- Søren Kierkegaard
-
May 24th, 2005, 09:14 AM
#5
Member
oops....its "war3_install.exe" not "wc3_install.exe" sorry...
-
May 24th, 2005, 09:20 AM
#6
Originally posted here by spellabc
oops....its "war3_install.exe" not "wc3_install.exe" sorry...
Aha. Now that makes a difference. Check this out:
http://www3.ca.com/securityadvisor/p...x?id=453075520
I only skimmed it (going to bed), but it's possible that you really are infected. It lists "war3_install.exe" as one of the possible processes that WhenU can run as. Scroll down near the bottom and you'll see it in the "Kill list." Just above the Kill list is the manual removal. Could try that and see what you turn up. Post your results.
Whether or not you find anything it might be good to post a HijackThis log here for review by a senior. You can get the latest version from here: http://www.spywareinfo.com/~merijn/downloads.html
- Xierox
"Personality is only ripe when a man has made the truth his own."
-- Søren Kierkegaard
-
May 24th, 2005, 10:39 AM
#7
Member
did a manual registry check (clean) and a manual search for files listed on your page
found these files:
war3_install.exe (deleted)
cmdlineext02.dll (unregistered n deleted)
scecomp.old (deleted)
setup_wm.exe (deleted)
and 2 suspicious files :
WAR3_INSTALL.EXE-22A239EF.pf (deleted) c:\windows\prefetch
WAR3_INSTALL.EXE-25D75D9C.pf (deleted)
deleted the entire content in my 'temp' and 'temporary internet files' folders
thx for your help
rebooting...
-
May 24th, 2005, 10:48 AM
#8
Member
Pestpetrol still detected "war3_install.exe" as a pest when i autorun my warcraft3 CD....
-
May 24th, 2005, 11:28 AM
#9
Pest Patrol is well known for its false positives. I'm certain this file, running from your temps, is part of your game. Open it with a hex editor or some such & peek through it if you want to be sure, but I wouldn't worry about it.
-
May 24th, 2005, 11:42 AM
#10
Member
thx....guess i can live with it
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|