What virus-trojan does alter the registery?

[Gery]

Hi to all,

Since a few days wmplayer is poping up with sometimes a white desktop.
and shortly after a Explorer error message does pop up.
When I click on "Don't send" or "Close" then the system sort of
freezes. If I push the error message just out of the way, every thing
works fine.

I never did anything that wmplayer would pop up (never before used
wmplayer).

I looked in the registery and there was an entry in:

HKLM\Softw.\Microsoft\Windows\Cur.Ver.\Run
for
mswspl wmplayer.exe and also for
nwiz nwiz.exe/install and
IZB4Go5.exe IZB4Go5.exe

Do you have any idea how the wmplayer key could get in the registery,
and do you know if the other 2 are ligit?




Regards Gery

Tanks for any replay

 

[Jason Wade]

I looked in the registery and there was an entry in:

HKLM\Softw.\Microsoft\Windows\Cur.Ver.\Run
for
mswspl wmplayer.exe and also for
nwiz nwiz.exe/install and
IZB4Go5.exe IZB4Go5.exe

Hi Gery

First, make sure you are behind a firewall.

Then go to the kaspersky web site and submit those files
to an online scan:
http://www.kaspersky.com/scanforvirus.html

nwiz.exe, IZB4Go5.exe, and wmplayer.exe should be checked.

Sometimes, malware overwrite wmplayer.exe in order to download
more malware.

You might also check out these utilities to help you remove
spyware:
Spybot Search and Destroy:
http://www.safer-networking.org/

Mcafee Stinger:
http://vil.nai.com/vil/stinger/

AdAware 6
http://www.lavasoftusa.com/software/adaware/


good luck and safe computing