Help save PC's life -- going to chuck it out window here...

KathrynH · Apr 9, 2005

Please help save my PC's life. I swear I am ready to throw it out the window!! I am having pop up trouble. I've installed and run just about everything out there to try and get rid of the file(s). Including the ones you lised in your post of steps to take before posting. Three of the 20ish programs found an adware file by OverPro that I can't remove manually!!

C:\WINDOWS\Downloaded Program Files\Wildapp.inf

I have XP set to show hidden and system files, yet when I use Windows Explorer to find it, it's not listed. Searching my system for the file doesn't work either!

I'm not even sure if this is the culprit. Please advise and thank you for your time.

chaslang · Apr 10, 2005

Files in the Downloaded Program Files folder will not show by normal methods. You have to use a special tool or you can use the command prompt and some DOS commands.

If you have run ALL of the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal

and you still have a prooblem, follow the steps below. But make sure you have run all those steps first.

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

KathrynH · Apr 10, 2005

Here it is.

KathrynH · Apr 10, 2005

I've been playing around your website and downloading this and that... So here is the latest HJT log.

KathrynH · Apr 11, 2005

Any advice out there? I'm opening the window...

chaslang · Apr 12, 2005

Is there a reason you skipped the Symantec online scan? Symantec may have fix this. I know they have detected before.

Try booting into safe mode and doing the following:

- make sure viewing of hidden files and system files is enabled per the READ ME FIRST
- run Windows Explorer
- look for and delete the following folder if found
C:\Program Files\WildArcade

Additional step to delete Wildapp.inf:
- Click Start, Run, and enter cmd in the box and click OK. This opens a commend prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\Downloaded Program Files\
attrib -r -h -s Wildapp.inf
del Wildapp.inf
exit

Now reboot and let me know the results of the above steps and how things are working.

KathrynH · Apr 21, 2005

Symantec found nothing for either the spyware scan or the virus scan. I had run just the spyware scan before. This time I ran both and both came back clean.

According to Windows Explorer, Wildarcade does not seem to exist on my PC. So I tried the command prompt, and it says the file wildapp.inf is not found. I even tried searching wild*.* and nothing of relevance was found. (If found some gif files and that's about it.) I do have my settings set to show hidden and system files.

Help! What now?

And by the way, I REALLY do appreciate your time and help. Thank you.

chaslang · Apr 21, 2005

Are you saying you did the below quote box steps

Additional step to delete Wildapp.inf:
- Click Start, Run, and enter cmd in the box and click OK. This opens a commend prompt windows.
- Enter the following command lines each followed by the enter key
cd C:\WINDOWS\Downloaded Program Files\
attrib -r -h -s Wildapp.inf
del Wildapp.inf
exit
Click to expand...

and you did not find the file? If so, explain to me what problems you are having.

KathrynH · Apr 21, 2005

That is exactly what I'm saying. It's also why I'm confused and seeking help.

When I scan with OverPro, it finds that my PC is infected with C:\WINDOWS\Downloaded Program Files\Wildapp.inf and wants me to pay for the version of their program that will remove it. I have not paid and really don't want to.

My problem is random pop ups with the names in the upper corner that say (I'm going from memory here) oinadserver and z1... something. I have PopThis installed plus the popup blocker with service pack 2. And these are the only pop ups I'm getting. I will go for a few days and not see a popup, then one day I get several. The only pattern is the first one will appear when I open my browser. The next one will appear when I surf to another page and so on. If my browser loads 5 pages, I get a total of 5 popups, etc.

I'm lost on not being able to find the WildArcade files and delete them, hence my original post.

Matacumbie · Apr 21, 2005

Looks like OverPro is adware, but let Chas decide the best action.

Just a little background here, http://securityresponse.symantec.com/avcenter/venc/data/adware.overpro.html

Steve

chaslang · Apr 22, 2005

Matacumbie said:

Looks like OverPro is adware, but let Chas decide the best action.

Just a little background here, http://securityresponse.symantec.com/avcenter/venc/data/adware.overpro.html

Steve
Click to expand...

I agree Steve!

Kathryn,

Please download the attached file and extract the getWDPF.bat file from it to your PC where you can locate it. Then double click on getWDPF.bat from Windows Explorer. It will create a file named c:\wdlfile-list.txt
Upload that file back here as an attachment.

Log in or Sign up

Help save PC's life -- going to chuck it out window here...

KathrynH Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

KathrynH Private E-2

Attached Files:

hijackthis.log

KathrynH Private E-2

Attached Files:

hijackthis2.log

KathrynH Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

KathrynH Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

KathrynH Private E-2

Matacumbie Rocky Top

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Attached Files:

getWDPF.zip