Weird worm/virus i can't get rid of...

[deept3]

hey guys, i'm new here

i formatted my system drive yesterday (didn't format the other drive with most of the data)
and there's some sort of a worm or virus or spyware that i can't get rid of.
tried a few anti-virus programs and none of them seemed to do anything.

this 'thing' creates random w########.exe files in my temp folder
and these guys are running in the background as long as they want until i shut them down, and then other ones pop in later.
i can see them in the task manager.

please i'd be glad to get rid of this annoying thing.

(also found an Lsass file running, don't know if it's bad, but i read it might be.)

and another thing.
here are some names of those 'w' files:
w1d004d0.exe
w2a2e34a.exe
w2b7b1b5.exe
w2e3094.exe
w3e5c4c5.exe
w3fb32ea.exe

 

[btk1w1]

Heya deept3,

Those *.exe (executable) files will be randomly named by the malware.

When you say you "reformatted" the system drive, did you reformat then reinstall the operating system?

Lsass can be legitimate or it can be related to the sasser worm. If you have reinstalled your operating system and your system is getting reinfected there is every possibily it resides on the other partition / drive.

Try the instructions provided at the link below and post the results of the logs if you need:

http://www.computing.net/answers/security/infected-start-here/22987.html

 

[btk1w1]

Please have the other drive connected whilst running the scans.

 

[connectionwizard]

If you click on this link http://www.connectionwizard.comoj.com/ and go to my malware removal section, there is detailed instructions that will help you. just click on the instructions link. the software is totally free and very easy instructions on using it. Everyone needs to get all the microsoft updates before the worm hits. Microsoft updates has a patch so you won't get it. I hear it's a bad one too. Tell your friends about this site when you are done. The site is currently under construction but I do have all the links for the software up and starting the instructions, now so be patient. Instructions for the first one are already in there.