I have a pop up from Antivirus software alert saying wltuser.exe is infected & u

1. 48

   nicki-1968posted 13 years ago

   I have a pop up from Antivirus software alert saying wltuser.exe is infected & unable to access
   
   is there a way i can clear this without paying a computer bloke £90 to come round to the house & clear it for me

   replyreport
2. 59

   animal-backpacksposted 13 years ago

   Is it the antivir virus?  My comp was infected with this recently and a fake security firewall kept telling me to download a patch and displayed messages like your one.  If it is the same you can try buying spyware doctor (a lot forums advised this) although it didn't work for me. 
   
   It's worth taking it to a decent sys admin person if you're not sure as it was a particularly malicious virus.

   replyreport
3. 60

   MickSposted 13 years ago

   Go to Microsoft and run their free malware checker, or Symantec to run their free system scan, they are both very thorough and do a good job.

   replyreport
4. 76

   charlemontposted 13 years ago

   I suspect that you're dealing with Antivirus System Pro. While it's just a fake antivirus among dozens with similar behavior, it might be a result of trojan virus infection like Zlob, which makes things a little, well, trickier.
   To begin with, I suggest checking the following folder:
   C:\Documents and Settings\{your name}\Local Settings\Application Data
   If you cannot see the directory, enable the display of hidden folders in Tools-->Folder Options-->View
   Look for a folder with randomly generated sequence of letters for a name.
   Inside the folder you'll find a single executable. It will have a random name with the word 'guard' in it, something like xxxxguard.exe
   Go to Start-->Run, type in MSCONFIG and click OK.
   Under Startup tab, look for that xxxxguard name, and clear the check box next to it. Click OK, apply for Windows to accept the change.
   Go to Start-->Run, type in services.msc and click OK. Services applet will load. Look for the process with that xxxxguard name, highlight it, click Properties, STOP the process and set it to Disabled startup.

   replyreport