strange virus

strange virus

Secure Home | Search | About
 Anti-Virus Software    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
strange virus Kevin M 02-24-2006
---> Re: strange virus David H. Lipman02-24-2006
Posted by Kevin M on February 24, 2006, 7:35 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Please help. I have a very strange virus or spyware issue as follows:

Running XP Pro
Norton AntiVirus (updated)

Files in my Windows\temp folder keep growing. Some of the files that appear
in the temp folder are .exe files. Most of these files cannot be deleted
even in safe mode. Usually, some of the .exe files which are in the temp
folder are a running process. I have scaned with Spybot, Ad Aware,
CWShredder, Trend Mico on-line and done scans with my Norton AntiVirus.
However, nothing I've done picks anything up. Spybot did pick up
wwwcoolwebsearch one time but deleted it. Also, I see nothing unusal in the
RUN keys of the registry.

Any suggestions would be greatly appreciated.

Thanks,

Kevin










Posted by David H. Lipman on February 24, 2006, 11:02 am
If you were  Registered and logged in, you could reply and use other advanced thread options

| Please help. I have a very strange virus or spyware issue as follows:
|
| Running XP Pro
| Norton AntiVirus (updated)
|
| Files in my Windows\temp folder keep growing. Some of the files that appear
| in the temp folder are .exe files. Most of these files cannot be deleted
| even in safe mode. Usually, some of the .exe files which are in the temp
| folder are a running process. I have scaned with Spybot, Ad Aware,
| CWShredder, Trend Mico on-line and done scans with my Norton AntiVirus.
| However, nothing I've done picks anything up. Spybot did pick up
| wwwcoolwebsearch one time but deleted it. Also, I see nothing unusal in the
| RUN keys of the registry.
|
| Any suggestions would be greatly appreciated.
|
| Thanks,
|
| Kevin
|


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go
through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal
Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the
PC.

You can choose to go to each menu item and just download the needed files or you
can
download the files and perform a scan in Normal Mode. Once you have downloaded
the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode
[F8 key
during boot] and re-run the menu again and choose which scanner you want to run
in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive
PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Kevin M on February 25, 2006, 9:05 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks, but this did not work.
>
> | Please help. I have a very strange virus or spyware issue as follows:
> |
> | Running XP Pro
> | Norton AntiVirus (updated)
> |
> | Files in my Windows\temp folder keep growing. Some of the files that
> appear
> | in the temp folder are .exe files. Most of these files cannot be deleted
> | even in safe mode. Usually, some of the .exe files which are in the temp
> | folder are a running process. I have scaned with Spybot, Ad Aware,
> | CWShredder, Trend Mico on-line and done scans with my Norton AntiVirus.
> | However, nothing I've done picks anything up. Spybot did pick up
> | wwwcoolwebsearch one time but deleted it. Also, I see nothing unusal in
> the
> | RUN keys of the registry.
> |
> | Any suggestions would be greatly appreciated.
> |
> | Thanks,
> |
> | Kevin
> |
>
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to
> go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in
> Normal Mode.
> This way all the components can be downloaded from each AV vendor's web
> site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and
> Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files
> or you can
> download the files and perform a scan in Normal Mode. Once you have
> downloaded the files
> needed for each scanner you want to use, you should reboot the PC into
> Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want
> to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal
> Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more
> comprehensive PDF help
> file. http://www.ik-cs.com/multi-av.htm
>
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>



Posted by David H. Lipman on February 25, 2006, 3:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Thanks, but this did not work.

Then it is NOT a virus and you need to look at what application has top store
TMP or other
files in the %windir%\temp folder. Maybe you need more physical RAM or Virtual
RAM enabled
such that the causative application doesn't have to create TEMP files in that
TEMP folder.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Kevin M on February 25, 2006, 11:54 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thanks, but no. I have 512 RAM and I've used this PC for about two yesrs.
Also, I noticed that a folder within the programs folder keeps appearing
called UCAS.
>
> | Thanks, but this did not work.
>
> Then it is NOT a virus and you need to look at what application has top
> store TMP or other
> files in the %windir%\temp folder. Maybe you need more physical RAM or
> Virtual RAM enabled
> such that the causative application doesn't have to create TEMP files in
> that TEMP folder.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>



Similar ThreadsPosted
Can't get rid of strange virus/spyware :-( May 22, 2006, 6:39 am
Strange Virus That AV Wont Recognize June 24, 2005, 2:50 pm
Strange virus alert by Trend Micro August 23, 2007, 10:07 pm
Another strange file-- what is this November 19, 2005, 2:00 pm
AVG strange download April 21, 2006, 2:32 pm
strange autorun.* April 24, 2007, 5:19 am
Strange Findings September 24, 2008, 6:05 pm
Strange behavior from computer August 27, 2005, 9:43 pm
Strange computer behavior -- please help November 13, 2005, 9:55 pm
Strange new trojan -> TR/Patched.O.2 January 10, 2008, 1:03 am

The site map in XML format XML site map

Contact Us | Privacy Policy