Need help removing "Timezone.exe"

By scribbler · 6 replies
Sep 16, 2007
  1. Hi,

    This is my first post here having just registered, due to a friend of mine speaking most highly of you guys.

    I hope somebody here can help me sort this issue out, as it is drying me nuts at this stage!

    To start with, every time I boot up my Laptop, which is running XP Pro with SP2, I keep getting a warning message from "WinPatrol Pro" telling me that "timezone.exe is trying to load in "start up" and it gives the directory address as C:\Program Files\Microsoft Time Zone\TimeZone.exe , but this DOES NOT exist in my C directory!

    I have tried deleting the registry entry for the same, but it just re-spawns itself back into the same part of the registry as if it were never deleter. The same thing happens when I try and disable it using WinPatrol just pops back up again in Start up as though I had never touched it! I have tried everything I can think of..including deleting on reboot using WinPatrol Pro and/or Windows Task Manager..nothing seems to work!

    WinPatrol Pro gives the following info on this program on their site..

    "Multiple Programs – TIMEZONE.EXE

    Timezone.exe is Microsoft's Daylight Saving Time Update Utility. This command-line tool that updates the daylight saving information for the current time zone in the registry. In some countries and regions, the start and end of daylight saving time are changed every year, and there is no fixed start or end date. TimeZone allows you to adjust the start and end of daylight saving time so that the computer's time setting is automatically updated on the correct dates. More info can be found at

    A file called timezone.exe may also install with third party time-set utilities. One example is CoolTimeZone by CoolTick software. More info can be found at

    Unfortunately, a file by this name also installs with the W32/Agobot-ADY virus. This virus spreads across weakly protected network. It places timezone.exe in your Windows\System or System32 folder. You may see it described as "MS Time". The virus may modify your Windows Hosts file making it difficult to get to antivirus or firewall related websites. It can also allow a remote user to access your computer. We'd recommend removing this file using WinPatrol. First, kill it under Active Tasks then remove it from your Startup Programs. If running WinPatrol 8.x or later, right click on the file then select "Delete file on reboot". Additional background information on this virus can be found at

    # Safe if not Virus"

    It is REALLY bugging me as it is trying to load every other minute or so and I have to keep denying it the right to..which is obviously interfering with using my Laptop in any sort of normal way!

    For the record, I have the following installed and use them frequently..

    Pegasus Mail
    Avast Anti Virus
    Ad-Aware SE Personal
    A-Squared Free
    A-Squared HiJack Free
    AVG Anti Virus
    AVG Anti Rootkit
    Clean My Registry
    Spybot S&D
    System Mechanic 4
    System Safety Monitor
    Wise Registry Cleaner

    I know some will think that having all the above is over-kill, but I don't think so, as they do a good job to date and do not cause any conflicts either on my system.

    The thing that I can't work out is that no program/file shows up every time I run a scan on my system, even System Safety Monitor, which shows all processes that are running on my system, is not showing this!

    It's as though there is some sort of software ghost lurking on my HD, that is trying to load itself as MS Timezone.exe..even though Timezone.exe is not on my PC..or at least, cannot be found by myself!

    Can somebody here please help me with this or walk me through how I can get rid of this thing once and for all?

    If you need logs or anything, just let me know, as well as how to get them so I can post them here.

    Here's hoping..

    All the best to everyone concerned..

  2. Tmagic650

    Tmagic650 TS Ambassador Posts: 17,243   +234

    Stop and take a breath. Delete most of that "protection" you have posted and Start here:

    Tell us what you discover after following these instructions carefully. Please post your location and some of your computer specs. We are not mind readers...

    You have gone way overboard with your protection. When one does this sort of thing, they are actually defeating protection and inviting trouble... as you are discovering here
  3. scribbler

    scribbler TS Rookie Topic Starter

    Thanks, Tmagic, for the info and dirctions on how to start dealing with this..much appreciated indeed!

    To start with, I am based in Ireland and my PC specs are as follows..

    OS Name Microsoft Windows XP Professional
    Version 5.1.2600 Service Pack 2 Build 2600
    OS Manufacturer Microsoft Corporation
    System Name BOB
    System Manufacturer Dell Computer Corporation
    System Model Inspiron 5160
    System Type X86-based PC
    Processor x86 Family 15 Model 4 Stepping 1 GenuineIntel ~2790 Mhz
    Processor x86 Family 15 Model 4 Stepping 1 GenuineIntel ~2790 Mhz
    BIOS Version/Date Dell Computer Corporation A08, 21/03/2005
    SMBIOS Version 2.3
    Windows Directory C:\WINDOWS
    System Directory C:\WINDOWS\system32
    Boot Device \Device\HarddiskVolume2
    Locale United States
    Hardware Abstraction Layer Version = "5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)"
    User Name BOB\Dan
    Time Zone GMT Daylight Time
    Total Physical Memory 1,024.00 MB
    Available Physical Memory 419.22 MB
    Total Virtual Memory 2.00 GB
    Available Virtual Memory 1.96 GB
    Page File Space 3.90 GB
    Page File C:\pagefile.sys

    As for the link you posted above and the instructions posted there, I've just finished step 11 and the AVG Rootkit software came up clear with no rootkits found. As for the other programs, I have attached the log files from both "SmitFraudFit" and "VirtumundoBeGone", but as you already know there is none for "VundoFix", which came out clear in any case.

    I'll continue on with the rest of the steps and let you know how they work out as and when I get them done.

    By the way, I followed your advice and removed most of the security software I had installed. Now I only have the following..

    AVG Free Antivirus
    AVG Anti-Spyware
    AVG Rootkit
    WInPatrol Pro

    Do you think there are any others I should keep or have that are worth installing?

    One strange thing is that the issue with TimeZone.exe seems to have disappeared at the time of writing this..but I didn't do anything aside from remove the software listed in my initial post above and follow your instructions so far. It is no longer showing up under the list of start up programs in WinPatrol Pro..and is not listed under active tasks either..nor is it listed in Windows Task Manager any more!

    Anyway, that's it for now. Please lt me know if I have missed something or if there is anything else I need do.

    Kind regards for now..



    Just finished Step 12 and I have attached the log file from both ComboFix and HJT(Crusty) to this post.

    More to follow..



    Finished Step 13 and the Anti Virus software came up with only a list of tracking cookies..all of which were deleted.

    Moving on to Step 14..



    Completed Step 14 and have attached a copy of the log report from AVG Anti-spyware regarding the same. A total of 9 things showed up..none serious though, as you will see in the report.

    Moving on to the next step..



    Just completed the final step (# 15) and due to the max # of attachments being 5, I cannot post the last HJT report..please let me know which of the attached files I can delete in order to add the last HJT file.

  4. Tmagic650

    Tmagic650 TS Ambassador Posts: 17,243   +234

    Ok Dan,
    you might have gotten lucky, and not be seriously infected. Just finish the steps and check out the operation of the system for a few days. Stick with the security software you have installed for now
  5. scribbler

    scribbler TS Rookie Topic Starter

    Thanks again, Tmagic..

    I have just tacked on the report from AVG Anti-spyware..and all still seems to be going well. I'll continue to follow the steps outlined in the post you linked me to and I'll also continue updating the post above as and when needed, until I have completed the steps outlined.

    All the best for now,

  6. scribbler

    scribbler TS Rookie Topic Starter

    OK..finished all 15 steps..but, as I posted above, I need to know which of the 5 files above I can delete in order to attach the last HJT report.

    Will do the same just as soon as I read your reply.

    All the best once again..

  7. scribbler

    scribbler TS Rookie Topic Starter

    I don't know if this has anything to do with the issue, but I have been running my Laptop now for the last few days with only the software outlined above..having followed your advice and removed most of the other stuff I was also running before..

    Anyway, today I ran a check with the suggested programs and all was fine..then I ran S (S&D) and turned back on the "TeaTimer" feature. The moment I did this, WinPatrol started popping up telling that "Timezone.exe is trying to load as a startup program and do I want to accept this or not.

    So turned off the resident/Teatimer feature again and closed S(S&D)..and what do you know?..Timezone.exe is no longer trying to load as a startup program and is no longer spawning itself on the list of active processes in WinPatrol.

    What all this means I don't really know. other than things seem to be fine as long as I do not run the resident/teatimer feature in Spybot -S&D. I don't seriously think there is anything "fishy" with Spybot..but it might be causing some sort of issue I am not PC educated enough to understand..maybe somebody here will though.

    My thanks for all th really is very much appreciated!

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...