Wscript.exe, Net.exe, Cdm.exe

Thansal

<div class="IPBDescription">what do these 3 programs have in comon?</div> aside from the fact that they like to spawn about 100 copies of each of them on my comp and then send my a long series of popup erros saying
wscript.exe failed to initiate properly

the fail to init also hapens with net.exe I don't know if cmd will do it alos (I generaly have to do a physical reset by that point)

I recently scanned my comp for viri (ussed housecall), ran ad-aware, and installed a firewall (linksys reouter set for full security, shields up can't find me)

ok, lets see:
Running win2K (full patches, correction, putting a few more on now)
Amd 1.1 gig
256 megs ram
SBLive
Geforce4

so can any one help me? (/me pokes MonsE)

oh, and don't bother suggesting reformat, I know that will probably fix it but I don't have the time now, if I can't find anytihng I know how to reformat.

Legionnaired

Could try msconfig in your run box and disabling them at startup?

DY357LX

The fact that the files are replicating themselves indicates a Virus.
I'd probably panic and format by now. Good luck with whatever it is.

Thansal

hmm, but there is the problem that cmd.exe is the dos propmpt (and no there is not a second copy of it somewhere)

CrouchingHamster

Is it cmd or cdm?

Anyway, this site reckons a modified version of wscript.exe could be a virus..

<a href='http://www.pacs-portal.co.uk/startup_pages/startup_all.php' target='_blank'>http://www.pacs-portal.co.uk/startup_pages...startup_all.php</a>

Best of luck.

Talesin

It's quite likely that you have a macro-virus of some sort. That or you installed a driver/program that needs to run in DOS mode, but can't deal with the WinXP 'DOS'. If it panics and dies each time it starts, it MIGHT force itself to start a new copy of the command shell (cmd.exe) every time it tries to reload itself.

More disturbing is wscript.exe, which leads me to believe it's quite possibly a macro-virus.

Net.exe... well, a quick <a href='http://www.google.com' target='_blank'>Google</a> search turns up this fun happy link:

<a href='http://miataru.computing.net/windowsxp/wwwboard/forum/62651.html' target='_blank'>http://miataru.computing.net/windowsxp/www...orum/62651.html</a>

Which in general says that it seems to possibly be spyware/adware that got slapped on your machine, quite possibly illegally through a NetBIOS exploit, if you were running at all open prior, or clicked 'yes' to any of the installer popups without reading it VERY carefully first.
I'd suggest doing as they say in the article and downloading anti-spy/adware software (such as <a href='http://www.lavasoftusa.com/' target='_blank'>Lavasoft's AdAware</a>) and cleansing your system. After which, I'd suggest downloading, installing, and configuring <a href='http://www.zonelabs.com/store/content/home.jsp' target='_blank'>ZoneAlarm</a>, a free firewall for Win32 machines. I've had no end of problems with Linksys routers and network interface units, doing tech support for computer shows and other location-based events... it'd be better to back up the 'router' with something a little more proven-dependable.

Thansal

/me bangs head on solid object

oy vey

ok, pc cillin SHOULD catch any viri... right?

I have run adaware (I do it every so often b/c I don't feel like disabling cookies, or making my self accept each and every one of them)

It is odd about the


oh screw it, I have a 5 page paper to write by 5 PM I tihnk I will go do that

thanks for all the help I will get back to yalls when I have time

GWAR

Sometimes the simplest solution is the best, Google is possibly the best thing ever for finding out what weird processes are...