G
Guest
Could someone please tell me how to get rid of this (WhenU.SaveNow) it
doesn't remove it, ever, not even in safe mode. So what do I do?
doesn't remove it, ever, not even in safe mode. So what do I do?
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an alternative browser.
You should upgrade or use an alternative browser.
R
Randy Knobloch
78sublime said:Could someone please tell me how to get rid of this (WhenU.SaveNow) it
doesn't remove it, ever, not even in safe mode. So what do I do?
Download and run HijackThis;
(http://aumha.org/downloads/hijackthis.zip)
Read this Tutorial *before* first use;
(http://www.bleepingcomputer.com/forums/index.php?showtutorial=42)
Once done > run HijackThis > save a scan log and post it to /any/ of the
following (expert) forums for analysis.
*Note, registration is required prior to posting a log.
- Not listed in any particular order -
(http://aumha.net/viewforum.php?f=30)
(http://www.bleepingcomputer.com/forums/forum22.html)
(http://www.dslreports.com/forum/security)
(http://castlecops.com/forum67.html)
(http://www.cybertechhelp.com/forums/forumdisplay.php?f=25)
(http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html)
(http://gladiator-antivirus.com/forum/index.php?showforum=170)
(http://forum.iamnotageek.com/f-130.html)
(http://forums.maddoktor2.com/index.php?showforum=17)
(http://www.spywarewarrior.com/viewforum.php?f=5)
(http://forums.spywareinfo.com/index.php?showforum=18)
(http://forums.techguy.org/f54-s.html)
(http://forums.tomcoyote.org/index.php?showforum=27)
(http://forums.subratam.org/index.php?showforum=7)
(http://www.5starsupport.com/ipboard/index.php?showforum=18)
Note! Prior to running HijackThis, you must;
http://wiki.castlecops.com/Malware_Removal:_Temporarily_Disable_Real_Time_Monitoring_Programs
Post back the URL where you posted your log, *not* the entire log.
Randy
--
siljaline
MS - MVP Windows (IE/OE) & Security, AH-VSOP
_________________________________________
Security Tools Updates
http://aumha.net/viewforum.php?f=31
Reply to group, as return address
is invalid that we may all benefit.
B
Bill Sanderson
--
B
Bill Sanderson
Look in the system event log (start, run, eventvwr.msc) and look for yellow
triangle messages with source WinDefend. That should show you the precise
path and object name involved. I believe you should be able to simply
delete this. This error is one which is put out when the infected item is
part of an archive file--a zip, for example. Microsoft does not want to
simply delete the whole zip in case there is valuable stuff in there in
addition to the malware--user your judgemet--consider renaming the file, for
example, and deleting it later--most such objects I've looked at so far are
"pure" spyware.
triangle messages with source WinDefend. That should show you the precise
path and object name involved. I believe you should be able to simply
delete this. This error is one which is put out when the infected item is
part of an archive file--a zip, for example. Microsoft does not want to
simply delete the whole zip in case there is valuable stuff in there in
addition to the malware--user your judgemet--consider renaming the file, for
example, and deleting it later--most such objects I've looked at so far are
"pure" spyware.