security warning box

[Guest]

Would appreciate some help here please. Windows xp sp2

My daughter who uses msn messenger clicked on a link a friend had on
messenger and ran it. Now every time I log on (to any of the 4 accounts we
have on this computer) we get this every time.

open file - security warning box

Name - system.exe
Publisher - Unknown
Type - Application
From - C:\windows\System32

Run or Cancel

I have Norton Antivirus 2005 and noticed that it was disabled after my
daughter clicked on the link in her chat with her friend. I turned it back
on and re booted my machine. I checked my nortons and discovered that now
the live update was disabled. I fixed that then went to see if I needed any
updates from msn but could not because automatic update was disabled. I
fixed that and I have all available updates...none were needed.

I also went to Norton's on line virus and security check and they did a scan
and said I was clean and well protected. I have run Norton's live update and
got the latest virus definitions and ran my Norton's full scan and it came up
no viruses.

I also ran Ad-Aware and also came up clean.

Not sure what I should do next? I have re:booted several times....and every
time this security warning comes up as soon as you log on to any of the user
names. It only happens when you first log onto each identiity...you can
switch identities after and it doesnt re-appear. But does happen 4 times...1
for every identity.

Can I restore my computer to a past date ( like last Friday) to see if that
fixes it? or should I do that? If I should how is it done on xp?

Thanks for any advise.

Jeannie

 

[Ramesh, MS-MVP]

Jeannie,

Definitely looks like a virus activity for me. Try Trend Micro's Sysclean
package (free), it's capable of eliminating keyloggers, trojans etc. Full
instructions at:

Generic Trojan / Adware Infestation Removal Procedure:
http://www.claymania.com/removal-trojan-adware.html

Trend Micro Sysclean package
http://aumha.net/viewtopic.php?t=10820

Once done, and maximum junk is eliminated by Trend Micro, follow the advice
here:

The Parasite Fight - Quick Fix Protocol:
http://aumha.org/a/quickfix.php

 

[Nepatsfan]

In spite of what Norton is telling you that file is probably some
sort of virus, worm or trojan. You might want to visit other
online virus scan sites. Here are a few you can try:

http://housecall.trendmicro.com/housecall/start_corp.asp

http://www.pandasoftware.com/activescan/

Here's a list of additional sites:

http://windowsxp.mvps.org/scanners.htm

To stop that warning from appearing you might want to try the
following:

Go to Start -> Run and enter regedit in the Open box.
Navigate to this location,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In the right hand pane look for an entry that mentions
system.exe.
Right click on this line and select Delete.
Close the registry editor.
Reboot your computer and see if the warning is still posted.

 

[Guest]

thank-you for your reply...will try what you suggested and let you know how I
make out. Acts like a virus to me too...figure it must be a brand new one
out, since Norton's says I am clean and so do therir on-line virus checker.
:-(

 

[Ramesh, MS-MVP]

All the Best, Jeannie. Sysclean is extremely good and should be able to
catch the culprits.