file1.exe keeps popping up

[wishbone346]

So I'm having a bit of a crisis on my PC. Every time I start up I get a message asking if I want to allow file1.exe to change my PC. Every time I do a scan with Malwarebytes I get at least one or two PUPs as well. Any advice on what this is and how to fix this would be greatly appreciated.

 

[shivababbli]

check your startup programs and disable unwanted services and if it is not solved create a kaspersky rescue disk and boot and do a scan

 

[wishbone346]

check your startup programs and disable unwanted services and if it is not solved create a kaspersky rescue disk and boot and do a scan

I tried doing a system restore and had no luck. I don't actually have kaspersky either. I'll try checking my startup programs like you said. Would you recommend kaspersky? I've pretty much been using malwarebytes exclusively for a while now.

 

[Paul NZ]

If ccleaner is installed go to tools/startup. Its entry is probably here.

Look where it's running from first. Then delete it.

Then reboot, then find it / delete it

 

[wishbone346]

File1.exe did not appear under my startup programs in ccleaner. Nothing seems to be working. I've googled this problem and come up with nothing but links to removal software that sounds just as malicious...

 

[rgd1101]

malware scan with these 2
https/www.malwarebytes.org/
http/www.bleepingcomputer.com/download/adwcleaner/

reg scan with this
http/www.piriform.com/ccleaner

 

[wishbone346]

So I did a scan with malwarebytes and with ccleaner. Both removed some stuff, but now upon restart I've received the "do you want to allow the following program to make changes to your computer" message again. However, now it's saying the program is file2.exe...

 

[rgd1101]

So I did a scan with malwarebytes and with ccleaner. Both removed some stuff, but now upon restart I've received the "do you want to allow the following program to make changes to your computer" message again. However, now it's saying the program is file2.exe...

and the adwcleaner?
Sound like you have a malware issue

 

[Paul NZ]

Get]http/simplysup.com/]Get trojan remover[/url]

Update it then scan. Hopefully it should find it and maybe other entries

If it does tell it to remove it / them

 

[rgd1101]

Get]http/simplysup.com/]Get trojan remover[/url]

Update it then scan. Hopefully it should find it and maybe other entries

If it does tell it to remove it / them

haven't heard of them before. where/how did you found them?

 

[Paul NZ]

I'm a registered user of it. They gave me a free key, years ago, when I found probs with it.

According to the site you pay yearly. The key they gave me is for a lifetime licence

It's for worms trojans etc. It does a thorough job, scans the registry entries, whats running in startup in the registry. Anywhere malware may hide

It'll also set settings to the default settings, if anything has changed them, like malware / trojans etc

 

[wishbone346]

So I did a scan with malwarebytes and with ccleaner. Both removed some stuff, but now upon restart I've received the "do you want to allow the following program to make changes to your computer" message again. However, now it's saying the program is file2.exe...

and the adwcleaner?
Sound like you have a malware issue

Yeah, malwarebytes seems to detect one to three PUPs ever time I scan after startup. Nothing seems to be working. Any other suggestions? Should I try that trojan remover that the other user suggested?

 

[rgd1101]

So I did a scan with malwarebytes and with ccleaner. Both removed some stuff, but now upon restart I've received the "do you want to allow the following program to make changes to your computer" message again. However, now it's saying the program is file2.exe...

and the adwcleaner?
Sound like you have a malware issue

Yeah, malwarebytes seems to detect one to three PUPs ever time I scan after startup. Nothing seems to be working. Any other suggestions? Should I try that trojan remover that the other user suggested?

let me highlight it for you
and the adwcleaner?

The trojan remover look ok except it not free.

 

[Paul NZ]

It'll probably find whatever it is and where it is. If it does tell it to remove it

 

[wishbone346]

So I did a scan with malwarebytes and with ccleaner. Both removed some stuff, but now upon restart I've received the "do you want to allow the following program to make changes to your computer" message again. However, now it's saying the program is file2.exe...

and the adwcleaner?
Sound like you have a malware issue

Yeah, malwarebytes seems to detect one to three PUPs ever time I scan after startup. Nothing seems to be working. Any other suggestions? Should I try that trojan remover that the other user suggested?

let me highlight it for you
and the adwcleaner?

The trojan remover look ok except it not free.

Yes, I've used the adwcleaner as well. It found nothing at all while malwarebytes found a few.

 

[wishbone346]

I actually found the file2.exe in Users>Owner>AppData>Roaming>LocalData
There seems to be quite a few objects in that folder including an application titled smsc. All of them were added today at different times as well. Should I delete them all?

 

[rgd1101]

http/www.tomsguide.com/forum/id-2646010/free-antivirus-free-internet-security-free-antispyware-solutions.html
Superantispyware
Spyware Blaster
Spybot Search & Destroy

Or might have to go to the paid apps. Or backup your data and do a system restore.

 

[Paul NZ]

If they've got the same name yup delete them. But I would still use trojan remover, it may find entries in the registry or somewhere else for them

 

[wishbone346]

http/www.tomsguide.com/forum/id-2646010/free-antivirus-free-internet-security-free-antispyware-solutions.html
Superantispyware
Spyware Blaster
Spybot Search & Destroy

Or might have to go to the paid apps. Or backup your data and do a system restore.

Already tried a system restore and had no luck. I'll take a look at some of those anti-virus softwares I guess.

 

[wishbone346]

If they've got the same name yup delete them. But I would still use trojan remover, it may find entries in the registry or somewhere else for them

Only two have the name file2 on them. The others are all different.