Les said:
I use spy sweeper and it has detected a possible problem
with a file "D:\windows\system32\winipe32.exe"
"Registry or startup folder: HKLM: Run"
It is identified as startup item "sys"
Spysweeper attempts to remove it but it immediately
returns.
Is that a good file or a bogey file?
A Google for "winipe32.exe" didn't bring up anything, so I would say it
is malware. Use more than one spyware removal tool, make sure you
update them, and then scan in Safe Mode. Here are general spyware
removal steps:
Remove spyware with Spybot Search & Destroy from
www.safer-networking.org and Ad-aware from
www.lavasoftusa.com. Be sure
to update these programs before running them. These programs are free,
so run them both since they complement each other. It is best to run
antivirus and spyware removal tools in Safe Mode. You may also want to
run CWShredder and HijackThis from
http://aumha.org/freeware.htm.
Although CWShredder is no longer being updated, it will still clean
older variants of the CoolWebSearch malware. Please read the
instructions carefully. Also, make sure you've visited Windows Update
and applied all security patches. Do not install driver updates from
Windows Update. Make sure you are running a firewall and have a current
antivirus using updated definitions installed.
Malke
