Malware Alert: Wserving.exe is Dangerous and Easy to Get

I was sitting at my computer placidly typing away when suddenly I started repeatedly hearing annoying clicking sounds and snatches of music!

That was my warning that my computer had been infected with Wserving.exe, which, research shows me, is a variant of the Trojan-Downloader.Win32.Delf.gru malware.

As you see in this summary of wserving.exe from Prevx, wserving.exe can do anything and everything from copying files and installing additional spyware/malware on your computer through collecting and transmitting personal information. (!!!)

You don't have to do anything to get hit by wserving.exe. Trojan downloaders like this one can be dropped onto your computer and activated without you even knowing about it. And anti-virus software may not pick it up. (My computer here is fully protected by a popular, well-known antivirus software that shall go unnamed - and completely ignored wserving.exe. Even the software's website doesn't even seem to know it exists at this writing.)

Wserving.exe is installed as a Windows NT, 2000, 2003, XP, or Vista service. Associated files that I found on my computer were:

• afinding.exe
• perfs.exe
• routing.exe
• ANDT.sys
• INDT2.sys

You may or may not see all of these files if your computer is infected.

To make the situation worse, Wserving.exe is very difficult to get rid of. Manually deleting the files does nothing; Wserving just reappears the next time you boot up. So you will need to clean your system by using anti-malware software especially designed for the job such as Prevx, Spyware Doctor or Sunbelt Software's new Vipre.

To prevent Wserving or any other viruses auto-starting on my computer, I'm running RegRun Niva.

Related:

• On this site: How to Avoid Computer Viruses
• Most Damaging Malware (About Antivirus Software)
• How to remove a Trojan, Virus, Worm, or other Malware (bleepingcomputer.com)