Need help to remove the virus (or adware Im not sure)

Hello all,

I have a strange problem with my computer which is on network. It
runs on Win2k. Everytime I restart my computer, its as slow and
sluggish as a tortoise. Files are automatically created and deleted in
winnt\temp directory with names like:

4504E2AF.qsp
qsp18.tmp
NSD19.tmp
00000000.txt
00000000.zip
4504E272.qsp
4504E283.qsp
qsp17.tmp
etc......

Each file size is about 15-20MB. This activity perishes after about
10min. I've also seen creation of spurious executable files in winnt
and system32 directories. Norton detects these created files as virus
but it has not fixed the root cause.

Could someone explain me what exactly is going on and how do I fix the
problem?

Thanks in advance,

Cheers,
Sachin

(E-Mail Removed) AKA in alt.comp.virus on 9/11/2006,after much
thought,came up with this jewel:

> Hello all,
>
> I have a strange problem with my computer which is on network. It
> runs on Win2k. Everytime I restart my computer, its as slow and
> sluggish as a tortoise. Files are automatically created and deleted
> in winnt\temp directory with names like:
>
> 4504E2AF.qsp
> qsp18.tmp
> NSD19.tmp
> 00000000.txt
> 00000000.zip
> 4504E272.qsp
> 4504E283.qsp
> qsp17.tmp
> etc......
>
> Each file size is about 15-20MB. This activity perishes after about
> 10min. I've also seen creation of spurious executable files in winnt
> and system32 directories. Norton detects these created files as virus
> but it has not fixed the root cause.
>
> Could someone explain me what exactly is going on and how do I fix the
> problem?
>
> Thanks in advance,
>
> Cheers,
> Sachin

The malware infection you caught is replicating itself.
Perform all removal instructions found below-post back with results.

max
--
Playing Nice on Usenet:
http://oakroadsystems.com/genl/unice.htm#xpost
My Pages:
Virus Removal Instructions
http://home.neo.rr.com/manna4u/
Keeping Windows Clean
http://home.neo.rr.com/manna4u/keepingclean.html
Windows Help and Tools
http://home.neo.rr.com/manna4u/tools.html
Change nomail.afraid.org to gmail.com to reply.
nomail.afraid.org is setup specifically for use in USENET
Feel free to use it yourself.

pcbutts1 wrote:
> http://www.pcbutts1.com/downloads
>

All stolen programs.



--
Posted via a free Usenet account from http://www.teranews.com

From: <(E-Mail Removed)>

| Hello all,
|
| I have a strange problem with my computer which is on network. It
| runs on Win2k. Everytime I restart my computer, its as slow and
| sluggish as a tortoise. Files are automatically created and deleted in
| winnt\temp directory with names like:
|
| 4504E2AF.qsp
| qsp18.tmp
| NSD19.tmp
| 00000000.txt
| 00000000.zip
| 4504E272.qsp
| 4504E283.qsp
| qsp17.tmp
| etc......
|
| Each file size is about 15-20MB. This activity perishes after about
| 10min. I've also seen creation of spurious executable files in winnt
| and system32 directories. Norton detects these created files as virus
| but it has not fixed the root cause.
|
| Could someone explain me what exactly is going on and how do I fix the
| problem?
|
| Thanks in advance,
|
| Cheers,
| Sachin

You say...
"Norton detects these created files as virus"

OK, as what ? What did NAV identify these file as being infected with ?

In the mean time...

Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

Hello all,

Thanks for your support. I used Lavasoft Adware Personal and ran it
in safe mode. It detected and removed some malicious registry keys
which was causing all this. Now the problem is fixed.

cheers,
Sachin

David H. Lipman wrote:
> From: <(E-Mail Removed)>
>
> | Hello all,
> |
> | I have a strange problem with my computer which is on network. It
> | runs on Win2k. Everytime I restart my computer, its as slow and
> | sluggish as a tortoise. Files are automatically created and deleted in
> | winnt\temp directory with names like:
> |
> | 4504E2AF.qsp
> | qsp18.tmp
> | NSD19.tmp
> | 00000000.txt
> | 00000000.zip
> | 4504E272.qsp
> | 4504E283.qsp
> | qsp17.tmp
> | etc......
> |
> | Each file size is about 15-20MB. This activity perishes after about
> | 10min. I've also seen creation of spurious executable files in winnt
> | and system32 directories. Norton detects these created files as virus
> | but it has not fixed the root cause.
> |
> | Could someone explain me what exactly is going on and how do I fix the
> | problem?
> |
> | Thanks in advance,
> |
> | Cheers,
> | Sachin
>
> You say...
> "Norton detects these created files as virus"
>
> OK, as what ? What did NAV identify these file as being infected with ?
>
> In the mean time...
>
> Download MULTI_AV.EXE from the URL --
> http://www.ik-cs.com/programs/virtools/Multi_AV.exe
>
> To use this utility, perform the following...
> Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
> Choose; Unzip
> Choose; Close
>
> Execute; C:\AV-CLS\StartMenu.BAT
> { or Double-click on 'Start Menu' in C:\AV-CLS }
>
> NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
> FireWall to allow it to download the needed AV vendor related files.
>
> C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
> This will bring up the initial menu of choices and should be executed in Normal Mode.
> This way all the components can be downloaded from each AV vendor's web site.
> The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.
>
> You can choose to go to each menu item and just download the needed files or you can
> download the files and perform a scan in Normal Mode. Once you have downloaded the files
> needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
> during boot] and re-run the menu again and choose which scanner you want to run in Safe
> Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.
>
> When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
> file. http://www.ik-cs.com/multi-av.htm
>
> Additional Instructions:
> http://pcdid.com/Multi_AV.htm
>
>
> * * * Please report back your results * * *
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm