Windows 7: Niwus.exe is a virus or spyware?

Hi everybody.....
When I start my laptop shown that niwus.exe want to connect internet, this program come from \program files\windows NT\, if I am allowed to connect to the Internet, the program spends approximately Internet quotas 70kb
Is this kind a new variant virus or spyware?, can't I delete them and how the the safe way to to remove them?
And here another file in windows NT, it call niwus.nof
The lister of niwus.nof:
URL,,Stealth Redirect To,http://stebuklas.dgorter2.hop.*********.net/ ,0,0
URL,,Stealth Redirect To,http://stebuklas.brammidas.hop.*********.net/ ,0,0
URL,,Stealth Redirect To,http://stebuklas.websellers.hop.*********.net/ ,0,0
URL,,Stealth Redirect To,http://stebuklas.btbet.hop.*********.net/ ,0,0
URL,,Stealth Redirect To,http://stebuklas.cragar.hop.*********.net/ ,0,0
URL,p,Stealth Redirect To,http://stebuklas.postyourhm.hop.*********.net/ ,0,0

Why this progam want to connect internet by visit to those sites?

2nd question:
My laptop installed AVG Internet Security v9.0.733
If I connect the internet my firewall say that the following program (windows) trying to connect:
wermgr.exe
rundll32.exe
service.xe
taskhost.exe
isass.exe
svchost.exe
msdt.exe
msiexec.exe
Can't I stop them by blocking to the internet connection?, and why Windows always try connect internet?
Please, I need advise.

Upload the file (Niwus.exe) to Virus Total, and if any A/V scanners pick it up as something nasty.

I can tell you that rundll32.exe, service.exe, taskhost.exe, svchost.exe, and msiexec.exe are safe if they are running from the \Windows\System32 or \Windows\SysWOW64 directories. The others in your second question may be safe, but I can't comment on them.

Hello, Welcome to SF,

According to some forums that file is a Virus. best thing to do would be disable from Startup.

Start > msconfig > Startup then if you find it uncheck it and reboot the System that should prevent from Starting up.

Also download Malwarebytes and run it.

Other services that your referring to are Windows services which you don't want to block.

Hope this helps,
Captain

Ok, stoping this program using msconfig.exe
If this virus, can't I delete folder \program files\windows NT\*.* ?
Many thanks

I would follow the advice given if i were you.

cheers.

Hi

As advised previously...

1 - Upload a File to Virustotal

• Highlight all the following in purple and press Ctrl+C on your keyboard to copy
  
• c:\program files\windows NT\niwus.exe
  
• Please click >here< to visit Virustotal
• Click into the blank box on the Virus Total page and press Ctrl+V on your keyboard to paste
• Click the Send File button
• Copy and paste the Virustotal results back here please

theres a new antivirus out that runs as a BAT file
called
ComboFix
try it let us know if it workss
even
Malwarebytes
dont panic and run them all at the same time if its a bad virus or spyware run in safe mode and use the antivirus to scan there thn youll have no porgrams running but your OS
cya

ComboFix is not an Antivirus.

I would add,, a skilled helper that gives you specific advice on how to use it and run it. Mainly the guys at the forums listed at the bottom of the link i provided.

Very true Tepid. Only EVER use Combofix when asked to by a Trusted person on a Trusted Security forum!!!

Same goes for any advanced Removal/ analysis software.

Yep! That cannot be stressed enough.