System 32 Files

[Joe McGuire]

Every day or so I get a message popping up from my firewall (McAfee Firewall
to the effect that a certain file is seeking access to the internet and the
firewall wants to know if I want to allow or block it. Of course, I have no
idea what these are and no idea which program such files relate to. These
files always seem to show up in the c:\Windows\System32 folder. Tonight is
was cjbljywt.exe. I block anything I don't recognize, which is pretty much
everything flagged, unless the warning appears when I am trying to access
some internet site. I presume my doing so is okay since I haven't seen any
significant problems.

Oddly, as I opened Outlook Express to access various Microsoft-related
bulletin boards my Firewall flagged the file wscript.exe, which was
described as "Microsoft (r) Windows Based Script Host" I blocked that, too,
and then noticed that I could not see any messages. Is there any way to
look these unknown programs up to see if they are related to any legitimate
programs?

 

[Rock]

Every day or so I get a message popping up from my firewall (McAfee
Firewall to the effect that a certain file is seeking access to the
internet and the firewall wants to know if I want to allow or block it.
Of course, I have no idea what these are and no idea which program such
files relate to. These files always seem to show up in the
c:\Windows\System32 folder. Tonight is was cjbljywt.exe. I block
anything I don't recognize, which is pretty much everything flagged,
unless the warning appears when I am trying to access some internet site.
I presume my doing so is okay since I haven't seen any significant
problems.

Oddly, as I opened Outlook Express to access various Microsoft-related
bulletin boards my Firewall flagged the file wscript.exe, which was
described as "Microsoft (r) Windows Based Script Host" I blocked that,
too, and then noticed that I could not see any messages. Is there any way
to look these unknown programs up to see if they are related to any
legitimate programs?

cjbljywt.exe is very likely malware related. the system is infected. Here
are some links with info on dealing with malware.

Malware Removal
http://www.elephantboycomputers.com/page2.html#Removing_Malware

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper's Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm

 

[Joe McGuire]

That's what I figured. I use Ad-Aware and some other protection but
obviously this slipped through. Thanks!