With all the protection I now have, I don't understand how I got this again but, for two days now, at startup, Antivir keeps telling me;

"The file C:\Program Files\WINAD CLIENT\WINAD.EXE contains code of the virus "TR/LowZones.A.3".

I choose to delete the file everytime but it keeps coming back. I do have a HijackThis log saved if it helps at all. Can anyone help? Thanx!

Hi sheryldotrock,

Let's try this one first before posting a log. Open Task Manager>Processes tab. Look for winad.exe. If found, highlight it and click End task.

Run AVG scan again and heal it.

Hi all. I also had a recent trojen in the program files in winad.exe. Apparenly, I think I cleaned the 2 trojens I have (one there and another in the system volume) so I think I am ok now. BUT what is this winad client thing. Is it a folder necessary to be in win xp and the trojen attatcked this particular folder?? Or should this entire folder be deleted. See......I still have the folder 12.5kb) in the program files. can you tell me if I should just send to the R-bin??

Hi azyardies,

Yes, delete the WinAd Client folder.
No, WinAd Client folder is not related to Microsoft Windows files. It's considered Trojan by some Antivirus programs and a pest by anti-spyware programs because it has the ability to dial a phone number and give unwanted ads.

More info at http://www.pestpatrol.com/pestinfo/w/winad.asp

I did a google search on Winad Client and found on some forums that Pest Patrol's online scan leaves files on your system even after uninstall and that it is not easy to remove the unwanted/unnecessary components. Is Pest Patrol legitimate or another program that leaves spyware

PestPatrol is a legitimate anti-spyware program. It is now acquired by Computer Associates, one of the leading company that sell antivirus program called eTrust Antivirus.

WinAd will reload if you attempt to end the process through task manager or through another program.

WinAd will also replace the registry key that loads it at startup if you attempt to delete the key. This is why HIJACKTHIS will not work.

WinAd will not allow you to delete the directory where the program resides, becuase the process "WINAD.EXE" is running.

If you THINK that you have "cleaned" it using a program, the test is very simple: Go to the Programs folder, locate the WINAD folder and delete it.
If the deletion goes through it has been cleaned, if it gives you an error, it because your system is still infected.

Only 2 ways to remove WINAD.EXE or its cousins WINADTOOLS.EXE and WINRATCHET, and they are both drastic measures:

1) On a FAT partition, boot up with a DOS diskette, change over to the programs directory, then the winad directory, then delete the files.

2) on an NTFS partition, remove the drive and hook it to another computer with NTFS capabilities (Win2k, Win XP) as a secondary drive. Then delete the winad directory.

A client of mine is preparing a lawsuit against the makers of this software and the company that distributes it. Please post if you would like to join.

Hello again,

I just noticed that this topic is posted in the wrong forum.

sheryldotrock wrote:

Antivir is AVPE, not AVG by Grisoft. Easy mistake to make.


Best regards

_________________

Microsoft MVP Consumer Security 2006, 2007 & 2008