Spyware, Viruses, & Security forum

General discussion


by Richard64 / February 13, 2005 12:04 AM PST

A friend of my told me that I had a virus called msn.exe. Is that right. Thanks in advance.

Richard jr

Discussion is locked
You are posting a reply to: msn.exe.
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: msn.exe.
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
by Donna Buenaventura / February 13, 2005 12:17 AM PST
In reply to: msn.exe.
Collapse -
by Richard64 / February 13, 2005 3:51 AM PST
In reply to: MSN.exe

Have Updated my antivirus, eTrust EZ Antivirus 2005, and Trendmicro and neither found anything . Everytime I turn around I am finding it in process, Prefetch, System volume, system restore and registry.

I am getting nowhere and I think I will reformat and see if I get rid of them that way. will post back


Collapse -
Why reformat?
by Donna Buenaventura / February 13, 2005 4:02 AM PST
In reply to: Update

Try an anti-trojan, anti-spyware programs to see if they will find any. Not all Antivirus program can detect trojan or spyware.

Maybe you really don't have it?

Collapse -
by sp_100 / February 13, 2005 8:06 AM PST
In reply to: Update
Collapse -
assuming you have the exact file path
by dawillie / February 14, 2005 12:12 PM PST
In reply to: Update

instead of the folder names you have indicated.....

Deleting a file from the folders you have mentioned will not help because the System will re generate it, on the next boot.

The folders in question are germane to the proper working of the O/S.

What you need to do is to D/L execute a program called ' Move on Boot'.

You can find it here.


you need to carefully note the EXACT path that the Trojan was found.

then open Move on Boot and at some point you will be presented with a 'drop down'.

scroll to indicate the exact location of the infected file, and now you will see in the window the path designated, looking something like this,
c:\windows\System 32\name of file.

click next and click 'delete'.

re boot and it will be gone.

Move on Boot as the name suggests is a piece of software that 'moves' a file during the boot process when the files are not being used and can be 'renamed', 'moved' or deleted.

use 'move on boot, found in your program files after installation, for each of the file folders indicating the exact path indicated and making sure that the MSN.Exe is how the path ends.

re boot after each 'delete' command.

Once this has been done, re-scan and you should be clean.

post back if the problem continues.

Collapse -
by Richard64 / February 14, 2005 3:24 PM PST

That went over my head. Please explain.


Collapse -
you have mentioned
by dawillie / February 14, 2005 9:01 PM PST
In reply to: HuH?

folders such as prefetch etc as being where this is.

you must therefore have the exact file path in the folder.

Move on Boot deletes just the file, that you indicate.

please conduct whatever scans you have previously done and note the EXACT location of the virus.

then use Move on Boot.

Collapse -
by Richard64 / February 15, 2005 12:41 AM PST
In reply to: you have mentioned

Thanks for the info and I feel and little more sure of the problem. Have been able to get rid of all except for 1 instance in the Registry. I seem to get rid of it but, it comes back when I reboot. It is in key Search Assistant and has removed one of the sub keys, it is in Hkey_Current_user software Microsoft Windows Current Version Cabinet State. Thanks again and if anyone has any answers I would appreciate it.


Collapse -
it is in a WIndows *.cab file
by dawillie / February 15, 2005 11:48 AM PST
In reply to: Status
'I seem to get rid of it but, it comes back when I reboot. It is in key Search Assistant and has removed one of the sub keys, it is in Hkey_Current_user software Microsoft Windows Current Version Cabinet State'.

at the risk of being repetitive, please scan again and note the exact location of the file.

the *.cab files like System 32 start at boot up.
Collapse -
remove from registry
by dawillie / February 20, 2005 6:22 AM PST
In reply to: Status

you have described the registry path.

go to start>run>regedit and browse to the path indicated.

highlight and delete.

registry entries once deleted do not regenerate, unless you re download the program.

Collapse -
Dumb Question
by Richard64 / February 13, 2005 3:04 PM PST
In reply to: MSN.exe

I am being totally overrun with this virus and nothing I have tried has found it. I am pulling my hair out. Is there any chance that this is a legitimate file?


Collapse -
That is not legitimate file
by Donna Buenaventura / February 13, 2005 4:00 PM PST
In reply to: Dumb Question


Is your system configured to show hidden files? If not, try to configure it to show hidden files and folders then search for MSN.exe again using Find/Search utility in Windows.

Check again the Processes for MSN.exe
Check the Registry for MSN.exe especially these area:

Try to use the applications if you haven't:
1. Ad-aware SE - http://www.lavasoftusa.com/software/adaware/
2. Spybot Search & Destroy - http://spybot.safer-networking.de/
3. CWShredder - http://www.intermute.com/spysubtract/cwshredder_download.html (Get the standalone version if you want. It is freeware)
4. Stinger - http://vil.nai.com/vil/stinger/
5. a2 anti-trojan - http://www.emsisoft.com/

If still can't find the MSN.exe, please do this:
Get HijackThis diagnostic tool.

HijackThis download locations:

Where to put and how to use HijackThis:

It is important that you will run HijackThis.exe in its own folder so the backup files that HijackThis file will create will not be accidentally deleted.

Open 'My Computer', then double-click to open C:\ (or the drive letter that your Windows is installed)
In the menu bar, click File-->New-->Folder.
That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis". Now you have C:\HJT\ or C:\HijackThis\ folder. Put your HijackThis.exe there, and double click to run it.

Click 'Scan' button. Click 'Save log' button. Save the 'hijackthis.log' in your desktop. Copy and paste the content of 'hijackthis.log' and post it forums that offers HijackThis analysis. Those forums can be found in http://www.a-sap.org

Your HijackThis log will be analyzed if your system is infected with any known or suspicious malware by HJT analysts.

Collapse -
by Richard64 / February 14, 2005 7:34 AM PST

Have run SpySweep, Ad-Aware, CA eTrust EZ antivirus 2005, Spybot, Microsoft AntiSpyware, Microsoft Titan, SpySubtract, CWShredder, Stinger. Spybot and SpySubtract found a couple of things but not msn.exe. Ran High Jack This, didn't find msn.exe. Will post HJT as soon as I find a Place. Tried everthing suggested and msn.exe is still there.


Collapse -
by Richard64 / February 14, 2005 12:23 AM PST
In reply to: msn.exe.

I wasn't trying to second guess you it is that I just got a new MSN9 disk from MSN and this is when I started having problems. I am in the process of doing what you suggested and will post and let you know how I make out


Collapse -
by Donna Buenaventura / February 14, 2005 4:53 AM PST
In reply to: msn.exe

Am not familiar with MSN9 but if you have it and has problem with MSN9 internet access, please write the error message or check with their http://support.msn.com/

See if you have MSN.exe in its installation directory C:\PROGRAM FILES\MSN or in the sub-folders (C:\Program Files\MSN\MSNCoreFiles\msn.exe)

Collapse -
Help, I don't have much hair let!
by Richard64 / February 14, 2005 11:38 AM PST
In reply to: MSN9

I am Having no luck what so ever getting rid of this even after a clean install I am overwhelmed withall the entries. And other help would be appreciated. Still looking for a Place to post HJT log. Thanks


Collapse -
Post your HijackThis log
by Donna Buenaventura / February 14, 2005 8:05 PM PST

in forums that offer HijackThis analysis. See http://www.a-sap.org/
Spyware Beware http://forums.maddoktor2.com/
SpywareInfo http://forums.spywareinfo.com/
Bleeping Computer http://www.bleepingcomputer.com/forums/forum22.html
CastleCops http://www.castlecops.com/forums.html
Gladiator Security http://forum.gladiator-antivirus.com/
Lockergnome http://help.lockergnome.com/
Net-Integration http://forums.net-integration.net/
Spyware Warrior http://www.spywarewarrior.com/index.php

You clean-installed the system but still having issues. What is the error message? What is the exact issue? Did you install MSN9 now?

Collapse -
Still trying to solve.
by Richard64 / February 15, 2005 12:40 PM PST

No error messages All Virus scans, Trogan, spyware and malware scans Show nothing but an isolated tracking cookie or 2. Found when looking in processes running, Doing searches, and in Registry.Has created no problems removed a Registry Key under Search Assistant. This is driving me crazy and my wife
is begining to think I am nuts. Thanks for all the help and if you have any other suggestion please let me know


Collapse -
No virus found after scans..
by Donna Buenaventura / February 15, 2005 4:16 PM PST
In reply to: Still trying to solve.

You deleted a registry under search assistant. That is the MSN.exe that you typed. That is not a file. The Windows Registry records the searches in the registry that is why you found it in your registry.

If no virus found after scanning the system with Antivirus, Antispyware, Antitrojan, online scan, your system is maybe clean. Your friend says you have a virus but you can't find the MSN.exe. You wrote that you have MSN9 and reinstalled Windows XP and no MSN.exe.

I think you don't have a malware but if you suspect that there is, please follow the suggestion to post HijackThis log in any forums that I mentioned. That will allow them to see if you really have anything that the security programs can't tell or find.

Collapse -
Problems Remain.
by Richard64 / February 20, 2005 4:25 AM PST
In reply to: msn.exe.

Still having problems with msn.exe. Have tried everything mentioned here including Posting my Hijack This log. If anyone has anymore suggestion I would appreciated.


Collapse -
Problem Solved
by Richard64 / February 22, 2005 5:58 AM PST
In reply to: msn.exe.

Formated master Boot and did clean install of XP Pro. Also Set Security and Privacy setting to high and Installed everything. No problems Since and it has been nearly twentyfour hours Thanks for all the help


Collapse -
Good work Richard
by Donna Buenaventura / February 22, 2005 11:09 AM PST
In reply to: Problem Solved

Glad to hear that you've resolved it Happy

Collapse -
Donna, It's BacK!!
by Richard64 / February 27, 2005 2:07 AM PST
In reply to: Good work Richard

Everything was fine, no sign of msn.exe, until I reinstalled MSN9. I rebooted and there it was in processes, search, and the registry. I disconnected from the net and removed MSN9. After making sure all was Cleaned and running I reinsatalled MSN9. Same problem. Everything I find on msn.exe as well as this forum say this is Malware of one sort or another. This is really beginning to get to me. Thanks in advance.


Collapse -
Try this Richard
by roddy32 / February 27, 2005 2:19 AM PST
In reply to: Donna, It's BacK!!
Collapse -
(NT) (NT) Thanks Roddy and all,
by Richard64 / March 1, 2005 8:11 AM PST
In reply to: Try this Richard
Collapse -
(NT) (NT) You're welcome Richard.
by roddy32 / March 1, 2005 8:20 AM PST

Popular Forums

Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions


Your favorite shows are back!

Don’t miss your dramas, sitcoms and reality shows. Find out when and where they’re airing!