msiexec.exe

[Empirean]

[Solved] msiexec.exe

hello guys, i printed some files on a local printing shop and when i accessed my flash drive at home there is a shortcut inside the drive that leads to my drive. i tried attrib but whenever i plug my flash drive to my computer my flash drive f*cks up. i noticed there is a fake msiexec.exe insi SysWOW64 folder. i havent seen this folder in my computer before. i tried deleting msiexec.exe in hopes to stop it from f*cking my drive but i cannot delete it cause i need permission. permission wtf im the admin here. i was thinkign of deleting the whole syswow64 folder but didnt cause the internet says not to. so can someone help me remove this msiexec.exe? thanks in advance

 

[Warseeker]

I really don't remeber that name of that software that can delete such difficult application... just seek out in the internet and download this software (It really working, but the problem is that I don't remember the name.. !?)

Or maybe because you have an ''ant-virus'' application runing like Avast, Avira... sometimes those application don't allow deleting like it happen to me the last time I install ''Deep freeze''(I hate this application). So my suggesion is : to disable your ant-protection for a while and take that time to delete that application (I'm not sure if It gonna work !!?)

No need to format your computer!

 

[Empirean]

I do not have any anti virus. Btw thanks for the response. Ive checked msconfig and found that there is service that runs power shell and executing some commands that bypass my settings. As i look for its origin i found its location in the registry but dunno i f i should delete it. I seek some advise on how to find it

edit: i figure i should remove the program that it is running when it starts. its calling windowspowershell and i dont remember installing that program so im gonna delete it but i cant cause of ownership issues

 

[edo494]

https://www.google.sk/?gws_rd=ssl#q=syswow64 easy enough to find

 

[Empirean]

A link to google?

 

[PublishedShadow]

Msiexec.exe is a Microsoft utility that allows you pass commands through it, and is used for installing applications of the .msi file type. SysWOW64 is part of the Windows Operating for backwards compatibility with x86 on x64 bit CPU's. I would recommend not deleting this folder and definitely would not mess with the registry.

If you want to see what msiexec does just open a command prompt and type "msiexec" and it will show you it's options, it's completely harmless and probably is not causing your issue.

Now, as for your USB drive not working, what filesystem (RAW, FAT32, NTFS, etc) is on it? Is it bootable? If it was ever formatted with linux, Windows generally doesn't like that and won't let you access it until you format it with a known filesystem.

It's hard to help you with what you have so far. I'd recommend putting up some screenshots of what you are seeing so we can get a better understanding of what's going on

 

[Empirean]

Hi, ive managed to disable the startup script that runs and also managed to delete the poser msiexec.exe. Now my problem is that some of my folders are hidden also, the script runs a command on powershell now im trying to delete the folder that contains powershell. However i cant cause i need permission from myself. Like why is this happening

 

[PublishedShadow]

What are you trying to resolve by deleting folders? The msiexec.exe is in every Windows PC syswow64 folder, it isn't a "poser". I'm very confused on what the actual problem is at this point.

 

[Empirean]

Any flash drive i plug unto my computer becomes a shortcut then i blame msiexec.exe for its occurence. Also powershell myteryously appeared soon after.

 

[PublishedShadow]

Hmm, would you mind posting screen shots? You can use the snipping tool to capture bits and pieces of your desktop.

 

[Empirean]

Ill do it man. Thanks for your help. But right now im only using my phone to connect here on hive.

 

[Dr Super Good]

Try running "sfc /scannow" in a command prompt.

 

[Empirean]

Ok i will once i get to my pc. Thanks for helping

 

[edo494]

if you dont care any of the stuff on the flash, you can just reformat it to frash state

 

[Empirean]

hello, yup ive reformat the flash mutiple times and each time i plug it in my pc the flash turns into a shortcut all because of the poser msiexec.exe. the contents of the flash can be retrieved using attrib command. anyway so far ive managed to delete the fake msiexec now the flash drive data no longer turns into a shortcut. the only problem left is that windows folder including system32 is hidden by default. also i still cannot delete the windowspowershell that i didnt know existed and dont remember installing. it cannot be found under control panel programs. also i took ownership of it and still cannot delete cause i need ownership from myself. the main problem has been solved but the other side effects arent. sure i can ignore the remaining problem as no other files are affected as long as the start up script has been deleted. btw i just wanna share that i used ccleaner to remove the start up. i think lets stop here. thank you guys for all your help.

 

[LordDz]

Are you sure you have a virus, and that you're not just destroying your computer in your attempt to remove the "virus"?

 

[Empirean]

i am certain that the msiexec.exe is a trojan. if you will read the thread i stated that it turns any flash drive into a shortcut and you will not be able to retrieve its contents unless you use attrib command. plugging it on other computer without formatting, the flash drive is ok. reformatting flash drive on my own pc then plugging it again will turn the contents into a shortcut.

 

[edo494]

Whats preventing you from shift-deleting msiexec.exe?

 

[Empirean]

yes. it requires some permission to delete it. i have managed to delete msiexec.exe now but i still cannot delete windowspowershell.

 

[Dr Super Good]

Startup in safe mode and try. If not then consider reinstalling the OS.

 

[Empirean]

Safe mode doesnt allow me to delete it as well.

 

[Mr. Gameplay Knowledge]

This will help u to understand the situation:
http://www.neuber.com/taskmanager/process/msiexec.exe.html
If this is really a fake,then download this free scanner:
https://www.malwarebytes.org/downloads/

 

[Empirean]

u see im trying not to download anything. i dont even have an anti virus. now that its gone, the flash drives dont turn into shortcuts anymore. i think its fixed.

 

[Mr. Gameplay Knowledge]

u see im trying not to download anything. i dont even have an anti virus. now that its gone, the flash drives dont turn into shortcuts anymore. i think its fixed.

U have not a scanner ,and not a antivirus ,and u use the internet.
I see already the grave of Empirean's PC.

 

[Empirean]

hahahaha but its been like this since 2012 and reinstalled the OS multiple times.