RE: Malware- tcexfst.sys



Phil wrote:



"Doug" wrote:

Has any one seen this on a system? tcexfst.sys

There is only 1 site on the web that seems to have heard of this file,

http://fileinfo.prevx.com/spyware/qqfd3a109197844-TCEX44939271/TCEXFST.SYS.html

It is listed as a process in the Task Manager.
It will start + stop audio on its own. Like for 10 seconds then stop.
I think it is very new. Like a few days old.

Doug

I managed to delete it from my computer but it keeps installing when i
turn it on.

It is not uncommon for malware to be protected by a "guard" file and/or a
rootkit and then to respawn. Since I don't know how you attempted to clean
your machine, here are general malware removal suggestions.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/page2.html#Removing_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

Standard disclaimer: I can't see and test your computer myself, so these are
just suggestions based on many years of being a professional computer tech;
suggestions based on what you've written. You should not take my
suggestions as a definitive diagnosis. If you can't do the work yourself
(and there is no shame in admitting this isn't your cup of tea), take the
machine to a professional computer repair shop (not your local equivalent
of BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may be
so infested that Windows will need to be clean-installed. If possible, have
all your data backed up before you take the machine into a shop.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

.



Relevant Pages

  • Re: NTVDM CPU Has Encounter Illegal Instruction
    ... Include scanning with David Lipman's Multi_AV and follow instructions to do ... Download and execute HiJack This! ... just suggestions based on many years of being a professional computer tech; ... all your data backed up before you take the machine into a shop. ...
    (microsoft.public.windowsxp.general)
  • Re: uthgnaz.exe - what the heck is it?
    ... Go through these general malware removal steps systematically - ... Include scanning with David Lipman's Multi_AV and follow instructions to ... shop (not your local equivalent of BigComputerStore/GeekSquad). ...
    (microsoft.public.windowsxp.general)
  • Re: My system is haunted!
    ... 17134.exe is running and is consuming quite a lot of memory space. ... Include scanning with David Lipman's Multi_AV and follow instructions to do ... shop (not your local equivalent of BigComputerStore/GeekSquad). ...
    (microsoft.public.windows.vista.security)
  • Re: when i start my pc the system configuration utility starts aut
    ... Include scanning with David Lipman's Multi_AV and follow instructions to do ... just suggestions based on many years of being a professional computer tech; ... machine to a professional computer repair shop (not your local equivalent ... all your data backed up before you take the machine into a shop. ...
    (microsoft.public.windowsxp.general)
  • Re: uthgnaz.exe - what the heck is it?
    ... Include scanning with David Lipman's Multi_AV and follow instructions to do ... http://tinyurl.com/yoeru3 - download link and more instructions ... shop (not your local equivalent of BigComputerStore/GeekSquad). ...
    (microsoft.public.windowsxp.general)

Quantcast