WoW64\systems.exe

[flaxe]

Hi there! First of all I wanna say that I couldn't find a good forum for this question, so I put it in Network & Sharing because it was the most closest to my question I think

I've used my Windows 7 64-bit for some months now and suddenly when I started my computer up then my NOD32 reacted on that systems.exe is trying to communicate to a remote computer, this is how it looks like:

http://img16.imageshack.us/img16/2651/nod32hm.png

Shall I allow this communication or deny it? Since it have never showed me this before then I wonder what it does...

Thanks!

 

[TGSoldier]

Deny it.

Systems.exe is not a legit process. Update your NOD32 and do a full scan.

Also, download Malwarebytes and do a full scan.

Download Malwarebytes Anti-Malware 1.44 - Download - FileHippo.com

 

[Jonathan_King]

I agree with the above poster. Definitely run a virus scan with Malwarebytes and Eset.

Malwarebytes Anti-Malware - Reviews and free Malwarebytes Anti-Malware downloads at Download.com

 

[flaxe]

Okey, thanks for a quick reply both of you!

When I denied it then another file was trying to communicate, this one is msdatasrc.exe located in C:\Users\Flaxe\AppData\Local\Temp\msdatasrc.exe

Shall I deny this one also? I'm going to scan my computer now with NOD32 and Malwarebytes Thanks!

 

[acurasd]

Okey, thanks for a quick reply both of you!

When I denied it then another file was trying to communicate, this one is msdatasrc.exe located in C:\Users\Flaxe\AppData\Local\Temp\msdatasrc.exe

Shall I deny this one also? I'm going to scan my computer now with NOD32 and Malwarebytes Thanks!

Yes you want to definitly deny that too.
what i suggest you d is update your virus definitions and unplug your computer from the internet until your computer is clean....

run it at least twice....to get all the bugs out.

 

[Jonathan_King]

Run a scan twice, or until no viruses are found

 

[flaxe]

Yes you want to definitly deny that too.
what i suggest you d is update your virus definitions and unplug your computer from the internet until your computer is clean....

run it at least twice....to get all the bugs out.

Ok I will do that I will be here on my laptop so I can read & reply to what you all are saying!

 

[stormy13]

what i suggest you d is update your virus definitions and unplug your computer from the internet until your computer is clean....

No kidding, that thing looks to be a keylogger,

Spyware.KGBSpy | Symantec

NTSF MICROSOFT SYSTEM - systems.exe - Program Information

 

[TGSoldier]

Download SuperAntiSpyware 4.33.1000 - Download - FileHippo.com

I've had Super Anti Spyware detect things that Malwarebytes did not. Download and scan with this one as well.

Also. Right click on "My Computer". Go to Properties. System Restore. Turn it off.

 

[stormy13]

Forgot to mention, if it is a keylogger hope you didn't do any online banking or anything like that. Might be a real good idea to start changing any and all passwords for everything from a known clean computer, the sooner the better.

 

[flaxe]

Ok thanks for all your replies, I have removed my internet-cable now so no internet is available on my pc
I'm currently running a Antimalware full scan and after that I will run NOD32 scan.

When those are done I will try the SuperAntiSpyware that TGSoldier mentioned above

Also stormy13, I haven't done any online banking or written in password today, but I did written in my password to several stuffs yesterday, but no online banking. But as it seems now nothing is changed on my passwords, but I will change for the ones that are important for me

Thanks all of you!

 

[flaxe]

Think I'm okay now

Have done a full scan with NOD32, Malwarebytes and SuperAntiSpyware three times now, the last time nothing was found on any of them.

I have also manually removed some keys to Systems.exe in the regedit so everything should be gone

Anyway, the thing that I just saw is that when I'm starting MSN then the ESET window is popping up again... below is link to picture of how it looks like:

http://img693.imageshack.us/img693/4232/sdam.png

If I'm denying it then MSN just shuts down, so I have to allow it in order to make it work... any suggestions? =)