[g2i2r4]

Follow the advise, UNLESS you don't have a disk with a driver for the mouse.

Run Killbox (doubleclick Killbox.exe).

Run it, and click the radio button that says Delete a file on reboot. For the file in the box below, paste it into the full path of file to delete box and click the red circle with a white cross in it.

The program will ask you if you want to reboot; say Yes.

Let the system reboot.

C:\Program Files\MouseWare\system\A0022285.exe

[Advertisements]

sorry for delay in replying - been away.

i have no disk for the mouse so no way of re-installing it - any suggestions?

[davmic0907]

sorry for delay in replying - been away.

i have no disk for the mouse so no way of re-installing it - any suggestions?

[g2i2r4]

The infected file is loaded bij em_exec.exe.
That file is from a Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove".

Can you put this file:
C:\Program Files\MouseWare\system\A0022285.exe
on a disk for save keeping.

Than reboot the system and check if your mouse will still run. Let me know please.

[davmic0907]

can't locate this program in order to save to disk & decided enough was enough & to bite the bullett & just run the killbox program & suffer the consequences.

However opened killbox & pasted the program as stated & this error came up

"pendingfilerenameoperations. registry data has been removed by external process"

what does this mean?

[g2i2r4]

It means the files you entered has already been removed by something else.
Maybe the steps we did above cleared it.

That means we're clean now!

[davmic0907]

can't see how as i haven't done anything yet - uninstalling the mouse was your first step so do i need to now go & do the previous steps ? & do i have to turn off microsoft spyware etc first?

[g2i2r4]

Can you please look at the bottom of the mouse?

Look for a manufacturer and a type.

Let's see if we can find a download for it so we can remove this one.

[davmic0907]

ok it is a logitech wheel mouse
lots of numbers printed underneath it M/N No. M-U69 S/N LZC12606539
does any of that help?

[g2i2r4]

Please see if you can find your mouse here.

[davmic0907]

sorry but this bloody search engine keeps popping up & won't let me get onto site to check.

[g2i2r4]

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

[davmic0907]

did this - made no difference.
ran new scan - results:

Scan Results: 26743 files scanned. 2 viruses were detected.

File Infection Status Path
EM_EXEC.EXE Win32.Holax.A infected C:\Program Files\MouseWare\system\
ms0b920b.dll Win32.Holax.A infected C:\WINDOWS\system32\

[g2i2r4]

You are infected with the rare CWS.Holax viral variant. Please run the Computer Associates online scan here:
http://www3.ca.com/s...sinfo/scan.aspx
Follow the prompts to scan your hard drive. When the scan is finished it will produce a report of infected files at the bottom of the screen. Please copy the entire text of this report and post it here for me to see.

I let you use this scanner, because in our second run this scanner is capable of curing the effected systemfiles.

[davmic0907]

this was the scanner i used yesterday & posted results above.

it doesn't give a "cure" option

[davmic0907]

also ran another mwav scan - results posted below:

File C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\ms0b920b.dll infected by "not-a-virus:AdWare.Visiter" Virus. Action Taken: No Action Taken.
File C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE infected by "Virus.Win32.Implinker.a" Virus. Action Taken: No Action Taken.
File C:\WINDOWS\System32\ms0b920b.dll infected by "not-a-virus:AdWare.Visiter" Virus. Action Taken: No Action Taken.
File C:\Program Files\AOL 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\Program Files\Common Files\aolback\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\WINDOWS\system32\ms0b920b.dll infected by "not-a-virus:AdWare.Visiter" Virus. Action Taken: No Action Taken.