CWS Trojans

[Wendy K. Walker]

Hi, OK I'm still new here and not really sure if I'm asking this question ion the right forum or not, but here goes.

I've attached a picture to this thread, if I did it right, to help ask my question; First, what can I do, if anything, to get my SpyBot pop-up alert to stretch down so that I can read what it says? It will stretch sideways, but not up or down.

Second, what is that warning trying to tell me? It seems to pop up every time that I open/close msconfig.

Is that telling me that something evil is going on, or is it normal?

I'm asking because CWS.MSCONFIG keeps showing up whenever I run CWShredder after having been in my msconfig, and that seems to be the only logical way that it keeps getting back in.

Rats, I looked at that attachment, and it doesn't look too good, so just in case it's unreadable on here, here's what it says;

C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe/auto

Thanks,
Wendy

[Zenobia]

Please see this thread:
http://forums.spybot.info/showthread.php?t=122
And this post by md usa spybot fan for further info:
http://forums.spybot.info/showpost.php?p=39159&postcount=2

What version of cwshredder are you using?

[Wendy K. Walker]

Hi Zenobia :yahoo: Thanks for the information, it worked great.
:bighug:
Wendy

[Zenobia]

You're welcome. :)

Do you know what version of cwshredder you are using?When you open it,it should say the version number at the very top.

[Zenobia]

I tried running cwshredder 2.19,after disabling an entry in msconfig,and it found
CWS.MSCONFIG,so I believe that may be a false positive.

Teatimer usually pops up with that info after using msconfig-
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe/auto

I have an entry like that in my Teatimer log,after using msconfig:

9/11/2006 10:40:20 PM Allowed value "MSConfig" (new data: "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto") added in System Startup global entry

Here's a description of MSConfig.exe as a start-up item.
http://www.castlecops.com/s2240-MSConfig.html

But,if you're having any problems,post back. :)