Unsolved
This post is more than 5 years old
4 Posts
0
1713
September 19th, 2009 10:00
McAfee Detected MWS In My System 32 Folder As Potentially Unwanted Program!
This is what McAfee detected on my computer today.
One or more items were detected on your computer.
Detection name: MWS (Potentially Unwanted Program)
File: C:\WINDOWS\System32\f3PSSavr.scr
Process: C:\WINDOWS\system32\rundll32.exe
Process description: Run a DLL as an App
I dont know if I should get rid of it as its in my system 32 folder?
No Events found!


Mary G
6 Operator
•
20.1K Posts
0
September 19th, 2009 11:00
The name is a screensaver file, but that means nothing. It could be a fake name. Let McAfee quarantine it and remove it. It seems to be associated with My Web Search Bar, a malware infection. Use Add remove programs to remove My Web Search Bar or program.
This is a Internet Explorer add on. Download Firefox and use that instead. It's safer. You'll still have IE, but with less problems. Google the file name for more like This.
Bugbatter
4 Apprentice
•
20.5K Posts
0
September 19th, 2009 12:00
There are several variants of malware that use this filename. Based on the filepath, what you have is more severe than what is associated with My Web Search Bar.. I suggest letting McAfee quarantine/remove the file. Following that, please run a follow-up scan with MBAM.
* If you are unable to download or install MBAM on your computer, see if you can use a friend's or family member's computer to download MBAM. Use the update link mentioned below to manually update. Once downloaded, rename the program installer "mbam-setup.exe" file to something else like "lookinhere.exe". Copy the installer file and the update file to a CD or flash drive. Transfer the files to the infected computer. Install the "lookinhere.exe" file, then run the update so that you will have the current definitions. After that, run a full system scan and select to have the program REMOVE whatever it finds.
alternate download link 1
alternate download link 2
MBAM will automatically start and you will be asked to update the program before performing a scan.
and just double-click on mbam-rules.exe to install.
Alternatively, you can update through MBAM's interface from a clean computer,
copy the definitions (rules.ref) located in
C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes'
Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
Back at the main Scanner screen:
Note:-- If MBAM encounters a file that is difficult to remove,
you may be asked to reboot your computer so it can proceed with the disinfection process.
Regardless if prompted to restart the computer or not, please do so immediately.
Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.
-- MBAM may make changes to your registry as part of its disinfection routine.
If you're using other security programs that detect registry changes (like Spybot's Teatimer),
they may interfere with the fix or alert you after scanning with MBAM.
Please disable such programs until disinfection is complete or permit them to allow the changes.
**If you need to re-install MBAM but encounter issue in re-installing, try using the MBAM Cleanup Utility by downloading it from HERE