Spyware/Adware problem (help please)

**bhxtyrant** · January 27th, 2005, 01:43 AM

Hello,

Recently ive been having a ton of problems with spyware/adware and i cant seem to get rid of it.It gets detected in Norton Antivirus 2005,and the latest version of Ad aware but neither program can seem to delete it.When i check my Proceses by using ctrl+alt+del i see a few that just recently started showing up such as packager.exe and wbniweui.exe.Now i believe that packager.exe may be a windows program but the second i am not to sure about.I hope someone here can help me out.Also what would be a good program to help prevent these things from infecting my PC again?I have Norton Systemworks 2005,Ad aware latest version,System Mechanic,and BulletproofSoft SPyware remover.Thank you for your time.

**SupaStar** · January 27th, 2005, 01:50 AM

Have you tried SpyBot? I often find this works when Ad-Aware fails (which it IMO rarely does).

**bhxtyrant** · January 27th, 2005, 01:55 AM

Nope i havent tryed it but i will take a look.Thanks for the quick reply.To be honest i think i got most of thise crap when downloading a new program.Perhaps you heard of it.I was watching G4Tech TV channel and saw an advertisement for some adware/spyware/antivirus program called stopsign.I figured id give it a test and after that is when most of this started.I already scanned through my HDD's manually and removed all the files i found that were obviously spyware and such.but a few just wont remove as it says access is denied ect.

**phishhead** · January 27th, 2005, 02:42 AM

eggheads spy remover guide.

**SupaStar** · January 27th, 2005, 02:42 AM

I see this alot at work. Many so-called anti-spyware apps actually install spy/ad-ware. SpyBot and Ad-Aware are 2 of the great ones that dont.

**bhxtyrant** · January 27th, 2005, 03:02 AM

Trying out the above guide.Thanks alot for the help guys.I am really glad i found this Forum.Its so hard to find help on these things.

**rik** · January 27th, 2005, 03:30 AM

You might also try either the Tea Timer from Spy Bot or Spyware Blaster which is another free app. Both seem to do a good job a keeping out new spyware apps as long as you keep them updated...

**bhxtyrant** · January 27th, 2005, 04:32 AM

After using all the above suggestions i think i got rid of all spyware and adware.I only have one question and that is can anyone tell me what the windows Xp process named "wbniweui.exe" is exactly.I do not remember ever seeing this process until recently and i can not close it.When i choose "end task" as soon as it closes it auto restarts again.Since i do not know if it is a normal file or spyware its drivig me a little insane.

**Reverend** · January 27th, 2005, 19:40 PM

Quote:

Originally Posted by bhxtyrant

windows Xp process named "wbniweui.exe" is exactly

Have you spelled it correctly ? I can't find any info on it

**Curio** · January 27th, 2005, 21:06 PM

Many worms and some adwares generate a random 8 letter filename to help to stealth them - notably some variants of CoolWebSearch trojan. You may be able to delete it using KillBox ( www.bleepingcomputer.com/files/killbox.php ) or you may be able to terminate the process using Process Explorer ( http://www.sysinternals.com/ntw2k/fr.../procexp.shtml ). Try 'suspend' then 'kill process tree'. You could also try Advanced Process Termination ( www.diamondcs.com.au/index.php?page=apt ) and TaskMan+ ( www.diamondcs.com.au/index.php?page=taskman )from Diamond CS.

**bhxtyrant** · January 28th, 2005, 00:21 AM

yes i am positive i spelled it correct i thought i misread it as well because i also tryed a google search.

Thanks Curio i will try those and post my progress

**bhxtyrant** · January 28th, 2005, 05:43 AM

Sorry about the double post.Just wanted to thank curio,i tried the programs you mentioned and killed the "wbniweui.exe" it seems that this was an exe file in my C:/WINDOWS/system32 folder and according to Process Explorer that file was running odly enough the calculator tool in the backround.Very weird.

Also wanted to ask does the name "Cypress USB Mass Storage Driver Notification Icon Application" or the filename "SM1nint.exe" look familiar?its in my PC and also wasnt on my PC before until recently.According to the properties tab its created by "Cypress Semiconductor"

**ilyail3** · January 28th, 2005, 16:14 PM

congrats

**Curio** · January 28th, 2005, 22:27 PM

Do you have a mp3 player or usb memory stick? It looks very much like your USB MASS stor.......blah is likely something to do with that.

**bhxtyrant** · January 28th, 2005, 23:18 PM

I have found the root to my problem.There are to files in the windows directory called Farmmext.exe and ernikw.exe now i have search on google and many people have had problems with these but heres my problem.I tried all the suggested removal tips and deleted these files and all traces of them.but then 5-10 minutes later they are suddenly back again

any idea how to get rid of them for good?

January 27th, 2005, 01:43 AM	#1
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	Spyware/Adware problem (help please) Hello, Recently ive been having a ton of problems with spyware/adware and i cant seem to get rid of it.It gets detected in Norton Antivirus 2005,and the latest version of Ad aware but neither program can seem to delete it.When i check my Proceses by using ctrl+alt+del i see a few that just recently started showing up such as packager.exe and wbniweui.exe.Now i believe that packager.exe may be a windows program but the second i am not to sure about.I hope someone here can help me out.Also what would be a good program to help prevent these things from infecting my PC again?I have Norton Systemworks 2005,Ad aware latest version,System Mechanic,and BulletproofSoft SPyware remover.Thank you for your time.

January 27th, 2005, 01:50 AM	#2
SupaStar all bets are off... TZ Veteran Join Date: Jul 2002 Location: Australia Posts: 1,790	Have you tried SpyBot? I often find this works when Ad-Aware fails (which it IMO rarely does). __________________

January 27th, 2005, 02:42 AM	#4
phishhead Friendly Neighborhood Super Moderator Join Date: Apr 2002 Location: San Diego, Ca. Posts: 3,882	eggheads spy remover guide. __________________

January 27th, 2005, 02:42 AM	#5
SupaStar all bets are off... TZ Veteran Join Date: Jul 2002 Location: Australia Posts: 1,790	I see this alot at work. Many so-called anti-spyware apps actually install spy/ad-ware. SpyBot and Ad-Aware are 2 of the great ones that dont. __________________

January 27th, 2005, 03:30 AM	#7
rik Old, Cranky and Perverted Super Moderator Join Date: Aug 2003 Location: Watching Your every move... Posts: 5,299	You might also try either the Tea Timer from Spy Bot or Spyware Blaster which is another free app. Both seem to do a good job a keeping out new spyware apps as long as you keep them updated... __________________ Spyware Removal Tips \| Read the Forum Rules Last edited by rik; February 6th, 2005 at 18:26 PM.

January 27th, 2005, 01:55 AM	#3
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	Nope i havent tryed it but i will take a look.Thanks for the quick reply.To be honest i think i got most of thise crap when downloading a new program.Perhaps you heard of it.I was watching G4Tech TV channel and saw an advertisement for some adware/spyware/antivirus program called stopsign.I figured id give it a test and after that is when most of this started.I already scanned through my HDD's manually and removed all the files i found that were obviously spyware and such.but a few just wont remove as it says access is denied ect.

January 27th, 2005, 03:02 AM	#6
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	Trying out the above guide.Thanks alot for the help guys.I am really glad i found this Forum.Its so hard to find help on these things.

January 27th, 2005, 04:32 AM	#8
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	After using all the above suggestions i think i got rid of all spyware and adware.I only have one question and that is can anyone tell me what the windows Xp process named "wbniweui.exe" is exactly.I do not remember ever seeing this process until recently and i can not close it.When i choose "end task" as soon as it closes it auto restarts again.Since i do not know if it is a normal file or spyware its drivig me a little insane.

January 27th, 2005, 21:06 PM	#10
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	Many worms and some adwares generate a random 8 letter filename to help to stealth them - notably some variants of CoolWebSearch trojan. You may be able to delete it using KillBox ( www.bleepingcomputer.com/files/killbox.php ) or you may be able to terminate the process using Process Explorer ( http://www.sysinternals.com/ntw2k/fr.../procexp.shtml ). Try 'suspend' then 'kill process tree'. You could also try Advanced Process Termination ( www.diamondcs.com.au/index.php?page=apt ) and TaskMan+ ( www.diamondcs.com.au/index.php?page=taskman )from Diamond CS.

January 28th, 2005, 00:21 AM	#11
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	yes i am positive i spelled it correct i thought i misread it as well because i also tryed a google search. Thanks Curio i will try those and post my progress

January 28th, 2005, 05:43 AM	#12
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	Sorry about the double post.Just wanted to thank curio,i tried the programs you mentioned and killed the "wbniweui.exe" it seems that this was an exe file in my C:/WINDOWS/system32 folder and according to Process Explorer that file was running odly enough the calculator tool in the backround.Very weird. Also wanted to ask does the name "Cypress USB Mass Storage Driver Notification Icon Application" or the filename "SM1nint.exe" look familiar?its in my PC and also wasnt on my PC before until recently.According to the properties tab its created by "Cypress Semiconductor" Last edited by bhxtyrant; January 28th, 2005 at 05:47 AM.

January 28th, 2005, 16:14 PM	#13
ilyail3 Member Join Date: Jun 2004 Posts: 98	congrats

January 28th, 2005, 22:27 PM	#14
Curio Triple Platinum Member Join Date: Nov 2004 Location: London Posts: 907	Do you have a mp3 player or usb memory stick? It looks very much like your USB MASS stor.......blah is likely something to do with that.

January 28th, 2005, 23:18 PM	#15
bhxtyrant Platinum+ Member Join Date: Jan 2005 Posts: 746	I have found the root to my problem.There are to files in the windows directory called Farmmext.exe and ernikw.exe now i have search on google and many people have had problems with these but heres my problem.I tried all the suggested removal tips and deleted these files and all traces of them.but then 5-10 minutes later they are suddenly back again any idea how to get rid of them for good? Last edited by bhxtyrant; January 29th, 2005 at 04:24 AM.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode