popups saying 'Warning Codecs may be out of date'

[Jenny1603]

Can anyone help please?

I am plagued by repeated pop ups saying that Codecs may be out of of date. If I close it, it just keeps coming back. If I click on check updates it sends me to an internet site which wants to sell me an update package.

McAfee tell me to contact my system provider and do not believe it to be a trojan. A google search leads me to lots of pages trying to sell me 'Spyware doctor' who say that it is a trojan.

I just want to get rid of the error messages.

Has anyone else had this and how do I solve it?

[stephensaxon]

You're not crazy, and neither is your computer.  It's a trojan or a hijack malware of some kind.  I haven't figured out out to remove it ('Spbot Search and Destroy' hasn't helped), and I'm still working on removing mine.  But I thought I'd let you know.  Perhaps we're on the forward edge of this one.  Not finding anything current about this type of infection from the normal sources, and that's disappointing.

Best of luck to us both.  Post your resolution if you find one.  I'll try to do the same.

Stephen (in California - funny that sony.co.uk don't allow for folks from the US to register on their board).

[stephensaxon]

Here's an update.

I downloaded McAfee's free scanner.  It found one trojan (but wanted $ to remove it).  I found the file, but couldn't delete it because it was in use.

I went to TaskMan to kill the process. In my case the executable was identified by McAfee as "7i317q3.exe" and it came in at about 3 MB, with a creation date of late last night.  This would be consistent with my observation of the problems starting first thing this morning.

It was located under Documents and Settings\...[blahBlahBlah]...\Temp.  Just do a Dir 7i317q3.exe /s to find where yours is.  Keep in mind that with a file name as odd as that, it may be generated fresh for each infection. As I mentioned, I couldn't delete the file because it was initially identified as "in use" by the OS.

The process was identified in TaskMan by the executable name (that's convenient).  Ended the process.  I actually renamed the file first, just in case it tried to reinvoke itself quickly - but that was probably not needed.

Then I was able to delete the file.

I just went through this, so I don't know if it's the actual solution.  But since I didn't click on any of the options provided by the malware, I think it was just looping and invoking itself, not a widespread infection.  Your mileage may vary.  I hope not to have any further updates on this, but thanks for being infected around the same time as I was .  That was a little bit comforting...

Best of luck!

Stephen.

www.gospelshabbat.com

[Jenny1603 · Accepted solution]

Hi Stephen,

Thanks for your help and support. My situation was complicated by the fact that I do pay for McAfee but was having continual problems with it claiming my subscription had expired and then switching off.

When I eventually got it running it found a trojan Artemis!3BF727337D25. It's probably just as well you didn't pay for McAfee to remove it because it wasn't able to. It kept prompting me for a restart because the infected file was in use but never managed to zap it before it was in use again. Fortunately it did pick up the infected file names. I seemed to have a new folder called ev in ProgramData and files such as bglrx, smartgroup, spoof and Fred32.dll.

Like you I managed to find the files running within the task manager - they were under processes rather than applications. Once we had killed the tasks we could move them to the recycle bin and empty it. On my first attempt at deleting one file. it came back but I hadn't emptied the recycle bin nor killed the other files.

I left the computer on over night and so far it has been clear of unwanted popups and trojan warnings so I hope it is finally sorted out.

Best of luck to anyone else who reads this to sort out their own similar problems,

Jenny