RE: Malware- tcexfst.sys

Phil wrote:

>
>
> "Doug" wrote:
>

>> Has any one seen this on a system? tcexfst.sys
>>
>> There is only 1 site on the web that seems to have heard of this file,
>>

http://fileinfo.prevx.com/spyware/qq...EXFST.SYS.html

>>
>> It is listed as a process in the Task Manager.
>> It will start + stop audio on its own. Like for 10 seconds then stop.
>> I think it is very new. Like a few days old.
>>
>> Doug
>>

> I managed to delete it from my computer but it keeps installing when i
> turn it on.

It is not uncommon for malware to be protected by a "guard" file and/or a
rootkit and then to respawn. Since I don't know how you attempted to clean
your machine, here are general malware removal suggestions.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

Standard disclaimer: I can't see and test your computer myself, so these are
just suggestions based on many years of being a professional computer tech;
suggestions based on what you've written. You should not take my
suggestions as a definitive diagnosis. If you can't do the work yourself
(and there is no shame in admitting this isn't your cup of tea), take the
machine to a professional computer repair shop (not your local equivalent
of BigComputerStore/GeekSquad). Please be aware that not all local shops
are skilled at removing malware and even if they are, your computer may be
so infested that Windows will need to be clean-installed. If possible, have
all your data backed up before you take the machine into a shop.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

Download and install SpyBot S & D, and scan in Safe mode.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

Important re: Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with Anti-virus and Spybot S & D while in Safe Mode

--
Mick Murphy - Qld - Australia


"Doug" wrote:

> Has any one seen this on a system? tcexfst.sys
>
> There is only 1 site on the web that seems to have heard of this file,
> http://fileinfo.prevx.com/spyware/qq...EXFST.SYS.html
>
> It is listed as a process in the Task Manager.
> It will start + stop audio on its own. Like for 10 seconds then stop.
> I think it is very new. Like a few days old.
>
> Doug
>

"Paul Montgomery" wrote:

> On Tue, 5 Aug 2008 09:37:12 -0700, Phil
> <Phil@discussions.microsoft.com> wrote:
>

> >
> >
> >"Doug" wrote:
> >

> >> Has any one seen this on a system? tcexfst.sys
> >>
> >> There is only 1 site on the web that seems to have heard of this file,
> >> http://fileinfo.prevx.com/spyware/qq...EXFST.SYS.html
> >>
> >> It is listed as a process in the Task Manager.
> >> It will start + stop audio on its own. Like for 10 seconds then stop.
> >> I think it is very new. Like a few days old.
> >>
> >> Doug
> >>

> >I managed to delete it from my computer but it keeps installing when i turn
> >it on.

>
> You need to run several malware removal programs.
>
> Spybot Search and Destroy
> SuperAntispyware
> AdAware
>

Seems like AVG detected it.

On Wed, 6 Aug 2008 09:46:01 -0700, Phil
<Phil@discussions.microsoft.com> wrote:

>> >I managed to delete it from my computer but it keeps installing when i turn
>> >it on.

>>
>> You need to run several malware removal programs.
>>
>> Spybot Search and Destroy
>> SuperAntispyware
>> AdAware
>>

>
>Seems like AVG detected it.

But it keeps coming back.

Run the malware scanners if you are really interested in taking care
of this. Otherwise learn to live with it.