New start program has been added, no info. on line

Recently there have been a bunch of start up programs that have been automatically added. I have blocked them for now, because I didn't add any programs and haven't been informed that Windows has updated.

Has anyone ever seen these programs and what do they do? Thanks;

SysBE10.exe
Sys901E.exe
Sys8AA2.exe
Sys7915.exe
Sys95F7.exe
Sys7FB9.exe
Sys863F.exe
Sys7FE8.exe
Sys8ED6.exe
Sys6EE8.exe

They all show:
File Name: SysXXXX.exe
Startup Value: C:\Windows\SysXXXX.exe
File Path: C:\Windows\SysXXXX.exe
Startup Type: Registry: Current User
Location: Software\Microsoft\Windows\CurrentVersion\Run
Classification: Disabled
SpyNet Voting: Not Available

Should I remove them?

Thanks...

Could you post a HiJackThis please?

Hi nashntth,

Do your home and/or search page display what you intend them to, or do they display a page from 'maxxxhosters'?

Filename: sys****.exe
Name: Ulubione
Description: Search Hijacker, redirecting to maxxxhosters.com - where **** are random characters
Recommendation: Definitely not required - typically viruses, spyware, adware and "resource hogs"

Please post a copy of a HiJackThis log to help us identify if this is, in fact, the case.

Also, perform FULL system scans using your anti-malware programs. These should be run in SAFE mode with your machine DISCONNECTED from the Internet whilst you do so. Allow them to automatically correct any issues that they find, and if they need to restart your machine, let them but remember to restart in SAFE mode and only restart normally when all scans have been completed. Please note that this may take several hours.
Dwarf

Pardon my ignorance, what is a HiJackThis log?

HijackThis - Wikipedia, the free encyclopedia

Grab it from the first link under the external links section.

Hello nashntth!

TrendSecure | Download TrendMicro™ HijackThis™

Install this, run a scan and attach (not copy/paste) the log file here.








Later Ted

Hi nashntth,

Information about HiJackThis (commonly referred to as 'HJT') can be found on the following webpage. You may also download HJT by following the links on this page.
Dwarf

TrendSecure | TrendMicro™ HijackThis™ Overview

Your Browser has been Hijacked
i have heard AVG is good for detecting and removing this trojan
the chances are you are using Norton... the biggest virus magnet know to man
you need to un install Norton before installing AVG....
however i use Avast but there is no mention of detection avast detecting SysXXXX.exe but thats not to say it wont

post you hijack this log for the others to see but in the mean time you could gave avg a try

Okay, I have attached the hijackthis log. Thank you.

Am I missing something, or are you not running an anti-virus program ... :eek:

http://www.avast.com/eng/avast_4_home.html













Later Ted

SpywareRemover is spyware itself by the way!

Hi nashntth,

Although I am not an HJT specialist, I have studied your HJT file and a number of issues stand out. Firstly, the number of '(file missing)' entries mentioned, especially involving 'lsass.exe'. Secondly, you appear to have an out of date version of Acrobat Reader. The current version is 9.0. Thirdly, your choice of Internet Security, 'cyberdefender', is suspect (I recommend using a well-established program, but steer clear of Norton (Symantec) and McAfee). Fourthly, 'SpywareRemover' is also suspect.
In view of the number of issues that I have been able to identify, my recommendation is that you reinstall Vista. Make sure that you keep your system up to date and that you install reputable anti-malware programs and NOT the ones that you have previously used. Here are some links to reputable programs.
Dwarf

Antivirus Software: Kaspersky Lab - Protection Against Malware and Cybercrime

avast! antivirus - high security and protection from malware with anti-spyware and anti-rootkit software built in

AVG Anti-Virus and Internet Security - Real-time protection against viruses, spyware and malicious websites

Ad-Aware @ Lavasoft - The Original Anti-Spyware Company - Lavasoft

The home of Spybot-S&D!

In additon: Malwarebytes.org - Malwarebytes AntiMalware and Rogue Remover.