some virus help needed ><

[boblikes]

ok.. i was messing around with Cheat engine and such so i decided to download BWH and get the ptr wallclimbing adress.. well i was looking around on the bwh site and came upon a link for bwh 1.84, so i downloaded it and when i started the .exe up nortan antivirus found 3 viruses, Spyware.perfect, Backdoor.Gaybird, and Inforstealer.Lineage. Nortan succesfully deleted all 3, but now everytime i start up my computer, right as windows finishes loading, i hear the Error sound, and when it loads my desktop theres a nice little window that says Error, windows could not load Win.exe, please use the search function to locate missing files. Im assuming that nortan deleted win.exe because it was probably part of the virus', but can somebody help me in stopping the missing file error? i tried using msconfig, but i cant find anything under services or startup that show executing win.exe ><.
thanks again!

--for now i just opened up notepad and saved a blank document as Win.exe and tossed it in the system32 folder, so when i start up msdos prompt flashes on and off, temp fix, but i really need to figure out how to stop the automatic execution of win.exe

[Fishy80]

ok Windows is trying to start win.exe because the trojan told it to (win.exe is the trojans actual server, since thats gone, your safe..) windows is still being told to run that file by a registry entry, or they set it up as a service...

Try start>run>services.msc and look for something that links to that win.exe and disable it, or, get a registry cleaner (I suggest registry first aid) and search for win.exe and delete registry entry's associated with that


you may not see the registry entry's as some trojans have features to hide the entry's... so... good luck, but at the same time, you've got nothing to worry about.

its sad that of 18 people reading it, im the only person to even attempt to help =/

[boblikes]

thanks man, my older brother came how from his trip, (its his comp) and he used a program called HijackTHIS to deleted the registry that the trojan put on the comp, thanks again!