Help.. "Noooh.. please try to open task manager etc" sys.exe

[RedSnapper]

Hi

I am getting a pop up from time to time (I think it is when I am using
my computer).

The pop up is headed 'Noooh' and says 'please try to open - task
manager - now' with a yes or no option.

I close it down with task manager then Win Patrol comes back with:

'A new start up program has been detected. c/windows/web/sys.exe'

I deny permission of course.

AVG is not picking anything up, any ideas what this is?

Regards

RedS

 

[Malke]

Hi

I am getting a pop up from time to time (I think it is when I am using
my computer).

The pop up is headed 'Noooh' and says 'please try to open - task
manager - now' with a yes or no option.

I close it down with task manager then Win Patrol comes back with:

'A new start up program has been detected. c/windows/web/sys.exe'

I deny permission of course.

AVG is not picking anything up, any ideas what this is?

Certainly. A quick Google for "sys.exe" shows that you are infected with
a Backdoor.ICR Trojan.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with either Sysclean or Multi_AV, plus AVG Anti-Spyware
(formerly Ewido - http://www.ewido.net/en/) and follow instructions to
do all scans in Safe Mode.

When all else fails, run HijackThis and post your log in one of the
specialty forums listed at the link above (not here, please).

Standard caveat: If the procedures look too complex - and there is no
shame in admitting this isn't your cup of tea - take the machine to a
professional computer repair shop (not your local version of
BigStoreUSA). Please be aware that not all local shops are skilled at
removing malware and even if they are, your computer may be so infested
that Windows will need to be clean-installed. Have all your data backed
up before you take the machine into a shop.


Malke