System and Msconfig closing

[rsam2011@yahoo.com]

I've recently made two installations on different machines and I had
the same problem on both of them.

This is very briefly what I did:

1. I formatted the hard disk
2. I installed Win XP SP2
3. Switched on Automatic Windows Update
4. Updated the network settings to connect to the web

Up till here I had no problems.

Then I went to my computer to view some folders/files. At that point,
something happens on the machine and I cannot open Msconfig and
neither System properties. The msconfig and system properties open but
then close immediately without letting me do anything.

I currently have these programs running in the task manager:
spoolsv.exe
wkhawlu.exe <<--- what is this?
svchost.exe
ikcswon.exe <<--- what is this?
lsass.exe
services.exe
winlogon.exe
csrss.exe
smss.exe
wmiprvse.exe

Now the very weird thing about all this is that I can browse with
internet explorer without any problems. However when I type the word
ikcswon in the browser, internet explorer closes immediately. I've
also ran different virus scanners without success.

Please help.
Thanks,
Bob

 

[Gerry]

ikcswon.exe -Some kind of Chinese Trojan -malware
http://translate.google.com/transla...=ikcswon.exe&start=10&hl=en&lr=&safe=off&sa=N

wkhawlu.exe -Some kind of Chinese Trojan -malware
http://translate.google.com/transla...search?q=wkhawlu.exe+&hl=en&lr=&safe=off&sa=N

http://www.elephantboycomputers.com/page2.html#Removing_Malware

--



Hope this helps.

Gerry
~~~~
FCA
Stourport, England
Enquire, plan and execute
~~~~~~~~~~~~~~~~~~~



rsam2011@yahoo.com wrote:
> I've recently made two installations on different machines and I had
> the same problem on both of them.
>
> This is very briefly what I did:
>
> 1. I formatted the hard disk
> 2. I installed Win XP SP2
> 3. Switched on Automatic Windows Update
> 4. Updated the network settings to connect to the web
>
> Up till here I had no problems.
>
> Then I went to my computer to view some folders/files. At that point,
> something happens on the machine and I cannot open Msconfig and
> neither System properties. The msconfig and system properties open but
> then close immediately without letting me do anything.
>
> I currently have these programs running in the task manager:
> spoolsv.exe
> wkhawlu.exe <<--- what is this?
> svchost.exe
> ikcswon.exe <<--- what is this?
> lsass.exe
> services.exe
> winlogon.exe
> csrss.exe
> smss.exe
> wmiprvse.exe
>
> Now the very weird thing about all this is that I can browse with
> internet explorer without any problems. However when I type the word
> ikcswon in the browser, internet explorer closes immediately. I've
> also ran different virus scanners without success.
>
> Please help.
> Thanks,
> Bob

 

[RajKohli]

Maybe, you start exploring your files without installing any Anti Virus and
Anti Spyware program. That is why your system is again got infected by those
Malware/Spaywares. If by mistake your system is ever got infected by a virus
or spyware and you have no choice to but reinstall your system then never
start exploring your files and folders after reinstallation. Because you
never know which file or folder is still infected. After reinstall your first
step should be to protect your PC (by installing Anti Virus and Anti Spyware
from CDs only. Not from Dumps) and run a full system scan.

Anyhow, according to me, you should now watch your Startup processes. As you
said there are 2 unknown process running and even Googling on them doesn't
show useful results. I will advise you to run download and run two beautiful
applications given in this link - ProcessExplorer and AutoRun. The procedure
to use those application has been given in the site.

http://technodigits.wordpress.com/2007/07/24/how-to-manually-remove-viruses-from-your-system/

There are also some online virus removal tools available in this site. If
the manual procedure doesn't work then try them.

Hope this help, let us know!

"rsam2011@yahoo.com" wrote:

> I've recently made two installations on different machines and I had
> the same problem on both of them.
>
> This is very briefly what I did:
>
> 1. I formatted the hard disk
> 2. I installed Win XP SP2
> 3. Switched on Automatic Windows Update
> 4. Updated the network settings to connect to the web
>
> Up till here I had no problems.
>
> Then I went to my computer to view some folders/files. At that point,
> something happens on the machine and I cannot open Msconfig and
> neither System properties. The msconfig and system properties open but
> then close immediately without letting me do anything.
>
> I currently have these programs running in the task manager:
> spoolsv.exe
> wkhawlu.exe <<--- what is this?
> svchost.exe
> ikcswon.exe <<--- what is this?
> lsass.exe
> services.exe
> winlogon.exe
> csrss.exe
> smss.exe
> wmiprvse.exe
>
> Now the very weird thing about all this is that I can browse with
> internet explorer without any problems. However when I type the word
> ikcswon in the browser, internet explorer closes immediately. I've
> also ran different virus scanners without success.
>
> Please help.
> Thanks,
> Bob
>

 

[rsam2011@yahoo.com]

Hi there,

I managed to solve the problem for now. I had to install Windows on a
different partition and formatted the other partitions not to leave
any previous files on the hard disk. I also did as you suggested and
installed an antivirus as soon as windows was installed. Up till now
it is working fine.

There isn't much information on those viruses for now, the only pages
i found were in Chinese. Hopefully someone finds a way to get rid of
this virus without re-installing Windows.

Anyway,
thanks again,
Bob

 

[RajKohli]

I will advise you, also to protect your PC against Spyware / Malware
infections. Because as the behaviour described by you is mostly caused by
them. Also if you have Pen Drive, Card Readers or any other removable media
then don't forget to scan them before use. It could be possible that you have
written data on them when your system was infected and ofcourse:

You're ALL-WAYS Welcome.

"rsam2011@yahoo.com" wrote:

> I've recently made two installations on different machines and I had
> the same problem on both of them.
>
> This is very briefly what I did:
>
> 1. I formatted the hard disk
> 2. I installed Win XP SP2
> 3. Switched on Automatic Windows Update
> 4. Updated the network settings to connect to the web
>
> Up till here I had no problems.
>
> Then I went to my computer to view some folders/files. At that point,
> something happens on the machine and I cannot open Msconfig and
> neither System properties. The msconfig and system properties open but
> then close immediately without letting me do anything.
>
> I currently have these programs running in the task manager:
> spoolsv.exe
> wkhawlu.exe <<--- what is this?
> svchost.exe
> ikcswon.exe <<--- what is this?
> lsass.exe
> services.exe
> winlogon.exe
> csrss.exe
> smss.exe
> wmiprvse.exe
>
> Now the very weird thing about all this is that I can browse with
> internet explorer without any problems. However when I type the word
> ikcswon in the browser, internet explorer closes immediately. I've
> also ran different virus scanners without success.
>
> Please help.
> Thanks,
> Bob
>

 

[rsam2011@yahoo.com]

Hi there,

It was a virus in fact, it was on one of my partitions and also copied
itself on my external drive.

The name of the file was dfawrrk.exe

I had an antivirus program but was not able to track it. Then I
downloaded Dr. Web and it immediately found it and removed. The trick
was not to browse any drives before running the anti-virus.

Thanks,
Robert

 

[RajKohli]

Glad to hear that your problem get solved.

"rsam2011@yahoo.com" wrote:

> Hi there,
>
> I managed to solve the problem for now. I had to install Windows on a
> different partition and formatted the other partitions not to leave
> any previous files on the hard disk. I also did as you suggested and
> installed an antivirus as soon as windows was installed. Up till now
> it is working fine.
>
> There isn't much information on those viruses for now, the only pages
> i found were in Chinese. Hopefully someone finds a way to get rid of
> this virus without re-installing Windows.
>
> Anyway,
> thanks again,
> Bob
>