W7services.exe

[fitzy]

W7services.exe VIRUS

hey guys, im having an issue with a virus that i cant find any information on..

the major file in the problem is called w7services.exe

files involved are:

c:\windows\w7services.exe
c:\7.exe
c:\documents and settings\"user"\local settings\temp\###.exe (### = 3 digit number)
a file called mwau.exe that is situated in an odd folder in c:\RECYCLER

and other files involved in spreading via flash drive.
(drive):\autorun.inf
(drive):\RECYCLER\(odd path name)

these files i can continually remove again and again, but they all keep coming back.

ive removed any traces of w7services.exe within "HijackThis" and "autoruns (sysinternals)".

theres no trace in the registry.

each time i remove them all, after about 30 mins one of the ###.exe files executes and brings up w7services.exe

w7services.exe shuts down all running programs rending malware scanners useless and starts replacing the files ive removed, starting with 7.exe and then the autorun.inf files on flash drives. mwau.exe seems to return after the computer restarts but it still seems to try and execute with the rest as it shows up in autoruns as "file not found".

my largest problem, is i cant find the trigger and no matter what i do using sys internals to find and survey them, i cant figure what is starting them.

at the moment my final resort is to backup all my extremely important data and format my windows drive hoping that there wont be any traces left when i reinstall windows from scratch.

(other info: im using windows XP pro x32, avast home edition (boot scan was unsuccessful), malware bytes, ad-aware pro) if you want anymore information from me just ask.. help is much appreciated.

 

[Tmagic650]

Try performing and posting the scans asked for in the 8-Step Virus & Malware Removal thread

 

[fitzy]

i managed to clear it out finally without reformatting, i used a program called ATF cleaner to clean out all possible temp files.

had to boot the computer with a boot cd

-removed all files in system volume information on any drive.
-removed all temp i could think of left over if there was any.
-deleted all RECYCLER folders.
-removed any traces of the forementioned virus files.
-rebooted and started running malware bytes.
-nothing popped up and malware bytes was allowed to run through cleaning out anything that could have been left behind.
- now im going to run a whole regiment of anti malware over my computer to be sure its clean.

 

[Tmagic650]

Good fitzy,
there's a nifty program called "Advanced SystemCare free" that i use... and I like it a lot

 

[Bobbye]

-deleted all RECYCLER folders.

You can't delete these folders. They are hidden, protected folders. The hold the file that you have delete the Recycle Bin.

You can open the Recycler folder, determine which SID is for your account, then delete those files.

The Recycler folder holds files for all accounts on the system. Each account had an SID. You can read more about the Recycler folder here: http://www.pcreview.co.uk/forums/thread-1509414.php

EDIT: See this: http://www.superantispyware.com/malwarefiles/W7SERVICES.EXE.html

 

[fitzy]

hate to tell you, but on a boot disk, all protection is voided, so i was then able to delete the RECYCLER folders to clean out the virus, this is why i am a technitian, cause i have the knowhow to get arround sutch issues.

 

[adam7979]

yes i suspect the root of all cause is the file sitting in c:\recycler\<random number>\mwau.exe. To remove it, get unlocker (google for unlocker and you shall get the first result easily) and unlock recycle bin, then remove everything in it.

next, browse to HKLM\software\microsoft\windows nt\currentversion\winlogon and remove "taskman" key

i'd suggest you do the above in safe mode as i saw the key was restored after i did the two steps above, perhaps it might come back... sigh, gonna restart my pc now

 

[Bobbye]

this is why i am a technitian, cause i have the knowhow to get arround sutch issues.

Too bad you didn't learn how to spell when you were 'learning' how to be a technician! You don't have to get around anything because such issues can be handled properly if you know how.

 

[Tmagic650]

"this is why i am a technitian"...

You're right Bobbye, a lot of Technicians can't spell or aren't smart enough to use Word to check spelling We are learning to "handle" such issues little by little here

 

[fitzy]

thanks t-magic =D. your right, it doesn't matter if you can spell to be able to be a technician, for all you know bobbye, i could be dyslexic, and your'e only adding insult to injury..

i was never any good at English anyway..

and Adam, i never noticed the taskman key in my registry, but since i cleared all that stuff, i've run multiple malware, spyware and virus scanners over my computer, so they may have already cleaned that.

and yes unlocker had been a great help as well, luckily enough i already had that program.

hopefully the knowledge in here is enough to help others with the same virus.. i love how these places are always useful in that sense