Member Avatar for 43sparkman

:?: Can anyone tell me what these files are and how to eradicate them:

MWMKyh.exe flagged by Zone Alarm as trying to access the internet

Adware.memwatcher.100 Trojan Guard flagged this.

BTW, I have continously run Spybot, Adaware, CWShredder, Trojan Hunter..

I keep getting alerts for Spyware popping up automatically on my desktop. Also, the Trojan Guard box freezes up when I attempt to clean the Adware file that is supposedly logded in my memory.

I appreciate any help.

:confused:

  • 5 Contributors
  • 4 Replies
  • 193 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by crunchie

Dani AI

Generated

As described (memory‑resident popup alerts and a process trying to contact the Internet), that pattern matches long‑running reports of the Adware/MemWatcher family: persistent, often memory‑resident adware that repeatedly appears across different scanners and can be stubborn to remove. Historical removal threads note it can come back from restore points or hidden autorun locations. (bleepingcomputer.com)

Recommended containment and first moves (ordered):

  1. Immediately isolate the PC (unplug network / disable Wi‑Fi) and use a clean machine to prepare any rescue media. NIST incident‑handling guidance emphasizes containment as the first priority. (nist.gov)
  2. From a clean computer make bootable rescue media (offline AV rescue ISO) and scan the infected machine outside Windows — this removes threats that hide while Windows runs. (support.kaspersky.com)
  3. If working inside Windows first, run updated on‑system removal tools (post‑infection tools such as the Microsoft removal utility and a modern anti‑malware scanner/toolset) but expect that a live OS scan may miss memory/rootkit components. (support.microsoft.com)

Practical troubleshooting tips: collect diagnostics (process list, autoruns, HJT/logs as requested by helpers), then use Process Explorer to locate the exact file path of any suspicious process and Autoruns to find and disable startup persistence before deleting/quarantining. If scanners hang while trying to remove a file in memory, kill the offending process (carefully) or use offline rescue media to delete it safely. ()

Note on System Restore and final recourse: System Restore can reintroduce infections; delete old restore points after cleaning. If multiple updated tools and offline scans cannot guarantee removal, back up personal data (scan that backup from a clean host), then perform a clean OS reinstall — that’s the only certain way to remove deeply persistent infections. After cleanup, change all passwords from a clean device and monitor accounts for misuse. (bleepingcomputer.com)

(References above show removal cases and recommended tools/workflows; the steps here expand on ’s and ’s suggestions by prioritizing containment, offline scanning, and using process/startup forensic tools before considering a reinstall.)

Recommended Answers

All 4 Replies

Member Avatar for jhdobbins

First off, the best spyware detector I've found is a beta version microsoft put out.

I have only been using it for about 2 weeks, but it seems to do a good job.

I had to reformat because viruses overran my computer... I think the day i did reformat i had 46 different ones. There was like 2,000 infected files or something.

One way you might be able to get rid of some of the problems is to goto

start - run - type in msconfig - goto startup tab - see if there are any of those files you mentioned, especially the trojan, and disable them... then maybe you can run some antivirus or at least keep some spyware off your computer...

I had to do that myself yesterday, I had 5 files I stopped on the startup.

Hope that helps, good luck, reformating can suck if you have to do that.

Member Avatar for Catalana

Yes, this forum can really help you!

Member Avatar for crunchie

Download HijackThis selfextracting zip version from here. Once downloaded, double click on the file & it will install into it's own, permanent folder.
Start HJT & press the "Do a system scan and save a log file" button. When the scan is finished a window will pop up giving you the option of where to save it. Save it to desktop where it is easy to access. Open the log file and copy the entire contents of the file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is necessary for the running of your system.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.