Suspicious Files

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I just discovered some files which I never noticed before. I submitted them
to VirusTotal but the scans did not find anything.
I also performed a scan with HijackThis v1.99.1 and had the log file
submitted and analyzed. The result of the log file was okay.
Anyway, since I am pretty sure for not having downloaded these files I am
worried that they may be anything but harmless.
I kindly request your request your expert opinion as how to handle these
files viz "SecTaskMan" in Documents and Settings, "XoftSpy" and
"InstallShieldInformation" both in Program Files.
10 answers Last reply
More about suspicious files
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    From: "Kayman" <Kayman@discussions.microsoft.com>

    | I just discovered some files which I never noticed before. I submitted them
    | to VirusTotal but the scans did not find anything.
    | I also performed a scan with HijackThis v1.99.1 and had the log file
    | submitted and analyzed. The result of the log file was okay.
    | Anyway, since I am pretty sure for not having downloaded these files I am
    | worried that they may be anything but harmless.
    | I kindly request your request your expert opinion as how to handle these
    | files viz "SecTaskMan" in Documents and Settings, "XoftSpy" and
    | "InstallShieldInformation" both in Program Files.
    |


    Xoftspy is a Rogue anti spyware application
    http://www.spywarewarrior.com/rogue_anti-spyware.htm#xos_note

    If it is listed on Spyware Warrior, the software should not be used.

    SecTaskMan in Google searches finds that this could be adware/spyware or an RBot worm.

    Remove both. Manually or via "Add/Remove programs". You may load in Sagfe Mode and
    manually remove folders and you may have to use legitimate anti spyware applications (those
    NOT listed as Rogues on Spyware Warrior).

    Since you are constantly having problems with malware, I think it is time you learn how to
    use a News Reader to access UseNet News Groups.

    The ones you need to access are...

    microsoft.public.security.virus
    alt.comp.virus
    alt.comp.anti-virus
    alt.privacy.spyware

    Using a News Reader to access News Groups is the preferred and impressively *better* way to
    access News Groups.

    The following URL will take your default News Reader (most likley Outlook Express) to the
    Microsoft Virus/Security News Group.

    news://msnews.microsoft.com/microsoft.public.security.virus


    The following URL will take your default News Reader anti spyware News Group

    news://aioe.cjb.net/alt.privacy.spyware

    The following URL will take your default News Reader anti virus News Group

    news://aioe.cjb.net/alt.comp.anti-virus


    Note that Microsoft hosts its own News Server; news://msnews.microsoft.com
    However, the News Groups that start with 'alt' (the ALTernate hierarchy) are purely public
    UseNet News Groups and require a public or private News Server. As a subscriber to Verizon,
    I can get to the alt.comp.virus and the alt.privacy.spyware News Groups via a Verizon
    provided News Server news.verizon.net but it is ONLY available to Verizon subscribers.
    That is why I posted a publicly availble, yey very limited News Server; aioe.cjb.net so
    you can access them.

    Because I use a News Reader and access News Groups properly (not using a web Browser front
    end) I can tell that you are posting from Thailand. You would haver to contact your ISP,
    Loxley Information Company Ltd., to find out if they offer a News Server for your use like
    Verizon does for its subscribers. If they don't you can continue using;
    news://aioe.cjb.net [ http://news.aioe.org/en/ ] or find another free or pay service
    (some only have a one time initial setup fee, others a monthly subscription).

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Kayman wrote:
    > I just discovered some files which I never noticed before. I
    > submitted them to VirusTotal but the scans did not find
    > anything.
    > I also performed a scan with HijackThis v1.99.1 and had the
    > log file submitted and analyzed. The result of the log file
    > was okay.
    > Anyway, since I am pretty sure for not having downloaded
    > these files I am worried that they may be anything but
    > harmless.
    > I kindly request your request your expert opinion as how to
    > handle these files viz "SecTaskMan" in Documents and
    > Settings, "XoftSpy" and "InstallShieldInformation" both in
    > Program Files.

    #1. Security Task Manager is a third party program that creates
    a folder in the following location:

    C:\Documents and Settings\All Users\Application Data\SecTaskMan

    If it doesn't sound familiar, here's more info on that program:

    Security Task Manger
    http://www.neuber.com/taskmanager/index.html

    Check in Control Panel -> Add/Remove Programs to see if you can
    uninstall it from there. If not, simply delete the folder.

    #3. The following is a legitimate hidden folder:
    C:\Program Files\InstallShield Installation Information
    It contains files related to many of the applications installed
    on your computer.

    I'd be suspicious if you found a folder with a similar name
    such as
    "InstallShieldInformation".

    Make sure your antivirus program is up-to-date and run a scan.
    You should also run a scan with AdAware and Spybot S & D.

    AdAware
    http://www.spychecker.com/program/adaware.html

    Spybot S & D
    http://www.spychecker.com/program/spybot.html

    You might also consider running some of the online virus
    scanners:

    http://housecall.trendmicro.com/

    http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm

    http://us.mcafee.com/root/mfs/default.asp?WWW_URL=www.mcafee.com/myapps/mfs/default.asp

    Good luck

    Nepatsfan
  3. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Thanks for response Nepatsfan.

    Found out that SecTaskMan is spyware related and XoftSpy got bad reviews in
    Spywarewarrior website. So I just removed and deleted these 2 folders which
    seemed to work without any complications.

    After having a second look it turned out that the folder is named
    InstallShield Installation Information and not what I had quoted in my
    original post. Sorry about that, must be more careful in future.

    Thanks again.


    "Nepatsfan" wrote:

    > Kayman wrote:
    > > I just discovered some files which I never noticed before. I
    > > submitted them to VirusTotal but the scans did not find
    > > anything.
    > > I also performed a scan with HijackThis v1.99.1 and had the
    > > log file submitted and analyzed. The result of the log file
    > > was okay.
    > > Anyway, since I am pretty sure for not having downloaded
    > > these files I am worried that they may be anything but
    > > harmless.
    > > I kindly request your request your expert opinion as how to
    > > handle these files viz "SecTaskMan" in Documents and
    > > Settings, "XoftSpy" and "InstallShieldInformation" both in
    > > Program Files.
    >
    > #1. Security Task Manager is a third party program that creates
    > a folder in the following location:
    >
    > C:\Documents and Settings\All Users\Application Data\SecTaskMan
    >
    > If it doesn't sound familiar, here's more info on that program:
    >
    > Security Task Manger
    > http://www.neuber.com/taskmanager/index.html
    >
    > Check in Control Panel -> Add/Remove Programs to see if you can
    > uninstall it from there. If not, simply delete the folder.
    >
    > #3. The following is a legitimate hidden folder:
    > C:\Program Files\InstallShield Installation Information
    > It contains files related to many of the applications installed
    > on your computer.
    >
    > I'd be suspicious if you found a folder with a similar name
    > such as
    > "InstallShieldInformation".
    >
    > Make sure your antivirus program is up-to-date and run a scan.
    > You should also run a scan with AdAware and Spybot S & D.
    >
    > AdAware
    > http://www.spychecker.com/program/adaware.html
    >
    > Spybot S & D
    > http://www.spychecker.com/program/spybot.html
    >
    > You might also consider running some of the online virus
    > scanners:
    >
    > http://housecall.trendmicro.com/
    >
    > http://www.pandasoftware.com/products/activescan/com/activescan_principal.htm
    >
    > http://us.mcafee.com/root/mfs/default.asp?WWW_URL=www.mcafee.com/myapps/mfs/default.asp
    >
    > Good luck
    >
    > Nepatsfan
    >
    >
    >
    >
    >
    >
    >
  4. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    I subscribed to microsoft.public.security.virus, alt.com.anti-virus and
    alt.privacy.spyware.

    I succesfully removed/deleted SecTaskMan and XoftSpy folders from their
    respective location. However they were not present in the "Add/Remove
    Programs" window which probably was a good thing.

    I ran a scans in safe mode with Ad-Aware and Spybot S&D - no findings.

    With respect to my previous post concerning Generic.CA-tr, I never received
    a result from McAfee for checking the submitted WordWeb password protected
    zip file. And since I did not not get a response from you I just
    removed/deleted the entire W/Web program. I only hope this did the trick!

    I wish to post a last request on this Newsgroup before swapping to the other
    Outlook Express based newsgroups.

    I am unable scanning with either application located in folder C:\AV-CLS
    after rebooting my computer. The "download indicator" which is monitoring the
    progress of the downloading operation for each scanning engine (Sophos, Trend
    and McAfee) shows that each download was successful. In fact I am able to
    scan right after completion of downloading still on-line. But once rebooted
    and accessing the start window for the 3 scanners and pressing the respective
    key for Sophos or Trend a message pops up "Pattern File not found. Computer
    shuts down to obtain Pattern File in normal mode". Pressing the key for
    McAfee an error message will display "c:\AV-CLS\Mcafee\update.ini not opened
    for READ, error code: [1]
    My FireWall(s) were definitely disabled.
    I removed and downloaded AV-CLS several times but no luck. There are
    probably some settings within my computer which may have to be adjusted.
    Could you kindly advise or direct my to the right person to look into this
    problem.

    "David H. Lipman" wrote:

    > From: "Kayman" <Kayman@discussions.microsoft.com>
    >
    > | I just discovered some files which I never noticed before. I submitted them
    > | to VirusTotal but the scans did not find anything.
    > | I also performed a scan with HijackThis v1.99.1 and had the log file
    > | submitted and analyzed. The result of the log file was okay.
    > | Anyway, since I am pretty sure for not having downloaded these files I am
    > | worried that they may be anything but harmless.
    > | I kindly request your request your expert opinion as how to handle these
    > | files viz "SecTaskMan" in Documents and Settings, "XoftSpy" and
    > | "InstallShieldInformation" both in Program Files.
    > |
    >
    >
    > Xoftspy is a Rogue anti spyware application
    > http://www.spywarewarrior.com/rogue_anti-spyware.htm#xos_note
    >
    > If it is listed on Spyware Warrior, the software should not be used.
    >
    > SecTaskMan in Google searches finds that this could be adware/spyware or an RBot worm.
    >
    > Remove both. Manually or via "Add/Remove programs". You may load in Sagfe Mode and
    > manually remove folders and you may have to use legitimate anti spyware applications (those
    > NOT listed as Rogues on Spyware Warrior).
    >
    > Since you are constantly having problems with malware, I think it is time you learn how to
    > use a News Reader to access UseNet News Groups.
    >
    > The ones you need to access are...
    >
    > microsoft.public.security.virus
    > alt.comp.virus
    > alt.comp.anti-virus
    > alt.privacy.spyware
    >
    > Using a News Reader to access News Groups is the preferred and impressively *better* way to
    > access News Groups.
    >
    > The following URL will take your default News Reader (most likley Outlook Express) to the
    > Microsoft Virus/Security News Group.
    >
    > news://msnews.microsoft.com/microsoft.public.security.virus
    >
    >
    > The following URL will take your default News Reader anti spyware News Group
    >
    > news://aioe.cjb.net/alt.privacy.spyware
    >
    > The following URL will take your default News Reader anti virus News Group
    >
    > news://aioe.cjb.net/alt.comp.anti-virus
    >
    >
    > Note that Microsoft hosts its own News Server; news://msnews.microsoft.com
    > However, the News Groups that start with 'alt' (the ALTernate hierarchy) are purely public
    > UseNet News Groups and require a public or private News Server. As a subscriber to Verizon,
    > I can get to the alt.comp.virus and the alt.privacy.spyware News Groups via a Verizon
    > provided News Server news.verizon.net but it is ONLY available to Verizon subscribers.
    > That is why I posted a publicly availble, yey very limited News Server; aioe.cjb.net so
    > you can access them.
    >
    > Because I use a News Reader and access News Groups properly (not using a web Browser front
    > end) I can tell that you are posting from Thailand. You would haver to contact your ISP,
    > Loxley Information Company Ltd., to find out if they offer a News Server for your use like
    > Verizon does for its subscribers. If they don't you can continue using;
    > news://aioe.cjb.net [ http://news.aioe.org/en/ ] or find another free or pay service
    > (some only have a one time initial setup fee, others a monthly subscription).
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    > http://www.ik-cs.com/got-a-virus.htm
    >
    >
    >
  5. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    From: "Kayman" <Kayman@discussions.microsoft.com>

    | I subscribed to microsoft.public.security.virus, alt.com.anti-virus and
    | alt.privacy.spyware.
    |
    | I succesfully removed/deleted SecTaskMan and XoftSpy folders from their
    | respective location. However they were not present in the "Add/Remove
    | Programs" window which probably was a good thing.
    |
    | I ran a scans in safe mode with Ad-Aware and Spybot S&D - no findings.
    |
    | With respect to my previous post concerning Generic.CA-tr, I never received
    | a result from McAfee for checking the submitted WordWeb password protected
    | zip file. And since I did not not get a response from you I just
    | removed/deleted the entire W/Web program. I only hope this did the trick!
    |
    | I wish to post a last request on this Newsgroup before swapping to the other
    | Outlook Express based newsgroups.
    |
    | I am unable scanning with either application located in folder C:\AV-CLS
    | after rebooting my computer. The "download indicator" which is monitoring the
    | progress of the downloading operation for each scanning engine (Sophos, Trend
    | and McAfee) shows that each download was successful. In fact I am able to
    | scan right after completion of downloading still on-line. But once rebooted
    | and accessing the start window for the 3 scanners and pressing the respective
    | key for Sophos or Trend a message pops up "Pattern File not found. Computer
    | shuts down to obtain Pattern File in normal mode". Pressing the key for
    | McAfee an error message will display "c:\AV-CLS\Mcafee\update.ini not opened
    | for READ, error code: [1]
    | My FireWall(s) were definitely disabled.
    | I removed and downloaded AV-CLS several times but no luck. There are
    | probably some settings within my computer which may have to be adjusted.
    | Could you kindly advise or direct my to the right person to look into this
    | problem.
    |

    Kayman:

    I don't know why you still have problems with the McAfee Moule. However, I know why you got
    "...Trend a message pops up "Pattern File not found". Trend Micro changed the URL that
    pointed to the Pattern Files and I had to re-program the scripts for that new URL. The
    Multi_AV.exe file has been updated and when you run and extract the files it should fix the
    Trend Micro problem.

    http://www.ik-cs.com/programs/virtools/Multi_AV.exe

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
  6. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Okay David, I am going to remove/delete the entire AV-CLS folder and
    re-download with the firewall disabled.
    The "Pattern File not Found" message also popped up when I hit the key for
    accessing Sophos.
    Would you please recommend a newsgroup which advises on non-virus related
    issues such as I am experiencing? (McAfee v4.40.0 is such an efficient tool!).
    Please note that I never had a problem with the "stand-alone" version which
    I already deleted since the virus data file can not be updated anymore.

    "David H. Lipman" wrote:

    > From: "Kayman" <Kayman@discussions.microsoft.com>
    >
    > | I subscribed to microsoft.public.security.virus, alt.com.anti-virus and
    > | alt.privacy.spyware.
    > |
    > | I succesfully removed/deleted SecTaskMan and XoftSpy folders from their
    > | respective location. However they were not present in the "Add/Remove
    > | Programs" window which probably was a good thing.
    > |
    > | I ran a scans in safe mode with Ad-Aware and Spybot S&D - no findings.
    > |
    > | With respect to my previous post concerning Generic.CA-tr, I never received
    > | a result from McAfee for checking the submitted WordWeb password protected
    > | zip file. And since I did not not get a response from you I just
    > | removed/deleted the entire W/Web program. I only hope this did the trick!
    > |
    > | I wish to post a last request on this Newsgroup before swapping to the other
    > | Outlook Express based newsgroups.
    > |
    > | I am unable scanning with either application located in folder C:\AV-CLS
    > | after rebooting my computer. The "download indicator" which is monitoring the
    > | progress of the downloading operation for each scanning engine (Sophos, Trend
    > | and McAfee) shows that each download was successful. In fact I am able to
    > | scan right after completion of downloading still on-line. But once rebooted
    > | and accessing the start window for the 3 scanners and pressing the respective
    > | key for Sophos or Trend a message pops up "Pattern File not found. Computer
    > | shuts down to obtain Pattern File in normal mode". Pressing the key for
    > | McAfee an error message will display "c:\AV-CLS\Mcafee\update.ini not opened
    > | for READ, error code: [1]
    > | My FireWall(s) were definitely disabled.
    > | I removed and downloaded AV-CLS several times but no luck. There are
    > | probably some settings within my computer which may have to be adjusted.
    > | Could you kindly advise or direct my to the right person to look into this
    > | problem.
    > |
    >
    > Kayman:
    >
    > I don't know why you still have problems with the McAfee Moule. However, I know why you got
    > "...Trend a message pops up "Pattern File not found". Trend Micro changed the URL that
    > pointed to the Pattern Files and I had to re-program the scripts for that new URL. The
    > Multi_AV.exe file has been updated and when you run and extract the files it should fix the
    > Trend Micro problem.
    >
    > http://www.ik-cs.com/programs/virtools/Multi_AV.exe
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    > http://www.ik-cs.com/got-a-virus.htm
    >
    >
    >
  7. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    From: "Kayman" <Kayman@discussions.microsoft.com>

    | Okay David, I am going to remove/delete the entire AV-CLS folder and
    | re-download with the firewall disabled.
    | The "Pattern File not Found" message also popped up when I hit the key for
    | accessing Sophos.
    | Would you please recommend a newsgroup which advises on non-virus related
    | issues such as I am experiencing? (McAfee v4.40.0 is such an efficient tool!).
    | Please note that I never had a problem with the "stand-alone" version which
    | I already deleted since the virus data file can not be updated anymore.

    Viruses:
    alt.comp.virus
    alt.comp.anti-virus
    microsoft.public.security.virus

    Non-viral malware
    alt.privacy.spyware

    You don't have to remove C:\AV-CLS Just run the latest version (v2.26) of Multi_AV.exe
    which will overwrite the files with their respective new versions.

    http://www.ik-cs.com/programs/virtools/Multi_AV.exe

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
  8. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Hi Dave:
    I removed C:\AV-CLS already. Anyway, I again started from scratch and
    downloaded C:\AV-CLS, after opening/closing zip and disabling firewall,
    started downloading McAfee first, followed by Trend And Sophos.

    McAfee, Wget ftp.nai.speedera.........Length 7,353,456 took about 28 mins
    to download at 3.42 - 3.44Ks

    Trend, Wget www.trendmicro.com/ftp/products/tsc/sysclean.......Length
    3,423,308 took about 20 mins to download at 3.00 - 3.30Ks
    Trend, Wget www.trendmicro.com/ftp/products/pattern\lpt.......Length
    7,643,028 took about 35 mins to download at 3.60 - 3.65Ks

    Sophos, Wget www.sophos.com/tools/sav32sfx.exe Length 7,486,008 took about
    33 mins to download at 3.60 - 3.71Ks
    Sophos, Wget www.sophos.com/downloads/idi/web_ides.exe.......Length 274,597
    took about 3 mins to download ar 3.59Ks
    Sophos, Wget www.sophos.com/tools/esdz.exe.......Length 7,369,105 took about
    32 mins at 3.65Ks.

    Performed clean boot and rebooted in normal mode.
    McAfee:
    c:\AV-CLS\McAfee\update.ini not opened for READ, error code [1]

    Trend:
    c:\AV-CLS\Trend\pattern.text not opened for READ, error code [0]

    Sophos:
    Working/Scanning (hooray), found a virus fragment 'w95/Sledge-A in file
    c:\WINDOWS\system32\ActiveScan\pskavs.dll Removal successful.

    Performed clean boot and rebooted in F8 safe mode.
    McAfee: Same error message.

    Trend: Same error message.

    Sophos:
    Sophos scan files were not found. The computer shuts down so you can obtain
    files in normal mode.

    Am I the only one having these kind if problems with AV-CSL?
    Please help me!

    As this is is a non-virus related issue please advise also if should visit
    another newsgroup/forum.

    "David H. Lipman" wrote:

    > From: "Kayman" <Kayman@discussions.microsoft.com>
    >
    > | Okay David, I am going to remove/delete the entire AV-CLS folder and
    > | re-download with the firewall disabled.
    > | The "Pattern File not Found" message also popped up when I hit the key for
    > | accessing Sophos.
    > | Would you please recommend a newsgroup which advises on non-virus related
    > | issues such as I am experiencing? (McAfee v4.40.0 is such an efficient tool!).
    > | Please note that I never had a problem with the "stand-alone" version which
    > | I already deleted since the virus data file can not be updated anymore.
    >
    > Viruses:
    > alt.comp.virus
    > alt.comp.anti-virus
    > microsoft.public.security.virus
    >
    > Non-viral malware
    > alt.privacy.spyware
    >
    > You don't have to remove C:\AV-CLS Just run the latest version (v2.26) of Multi_AV.exe
    > which will overwrite the files with their respective new versions.
    >
    > http://www.ik-cs.com/programs/virtools/Multi_AV.exe
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    > http://www.ik-cs.com/got-a-virus.htm
    >
    >
    >
  9. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    From: "Kayman" <Kayman@discussions.microsoft.com>

    | Hi Dave:
    | I removed C:\AV-CLS already. Anyway, I again started from scratch and
    | downloaded C:\AV-CLS, after opening/closing zip and disabling firewall,
    | started downloading McAfee first, followed by Trend And Sophos.
    |
    | McAfee, Wget ftp.nai.speedera.........Length 7,353,456 took about 28 mins
    | to download at 3.42 - 3.44Ks
    |
    | Trend, Wget www.trendmicro.com/ftp/products/tsc/sysclean.......Length
    | 3,423,308 took about 20 mins to download at 3.00 - 3.30Ks
    | Trend, Wget www.trendmicro.com/ftp/products/pattern\lpt.......Length
    | 7,643,028 took about 35 mins to download at 3.60 - 3.65Ks
    |
    | Sophos, Wget www.sophos.com/tools/sav32sfx.exe Length 7,486,008 took about
    | 33 mins to download at 3.60 - 3.71Ks
    | Sophos, Wget www.sophos.com/downloads/idi/web_ides.exe.......Length 274,597
    | took about 3 mins to download ar 3.59Ks
    | Sophos, Wget www.sophos.com/tools/esdz.exe.......Length 7,369,105 took about
    | 32 mins at 3.65Ks.
    |
    | Performed clean boot and rebooted in normal mode.
    | McAfee:
    | c:\AV-CLS\McAfee\update.ini not opened for READ, error code [1]
    |
    | Trend:
    | c:\AV-CLS\Trend\pattern.text not opened for READ, error code [0]
    |
    | Sophos:
    | Working/Scanning (hooray), found a virus fragment 'w95/Sledge-A in file
    | c:\WINDOWS\system32\ActiveScan\pskavs.dll Removal successful.
    |
    | Performed clean boot and rebooted in F8 safe mode.
    | McAfee: Same error message.
    |
    | Trend: Same error message.
    |
    | Sophos:
    | Sophos scan files were not found. The computer shuts down so you can obtain
    | files in normal mode.
    |
    | Am I the only one having these kind if problems with AV-CSL?
    | Please help me!
    |
    | As this is is a non-virus related issue please advise also if should visit
    | another newsgroup/forum.

    You are the only one experiencing problems :-(

    --
    Dave
    http://www.claymania.com/removal-trojan-adware.html
    http://www.ik-cs.com/got-a-virus.htm
  10. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Thanks for all your help, David.

    With all good wishes,

    "David H. Lipman" wrote:

    > From: "Kayman" <Kayman@discussions.microsoft.com>
    >
    > | Hi Dave:
    > | I removed C:\AV-CLS already. Anyway, I again started from scratch and
    > | downloaded C:\AV-CLS, after opening/closing zip and disabling firewall,
    > | started downloading McAfee first, followed by Trend And Sophos.
    > |
    > | McAfee, Wget ftp.nai.speedera.........Length 7,353,456 took about 28 mins
    > | to download at 3.42 - 3.44Ks
    > |
    > | Trend, Wget www.trendmicro.com/ftp/products/tsc/sysclean.......Length
    > | 3,423,308 took about 20 mins to download at 3.00 - 3.30Ks
    > | Trend, Wget www.trendmicro.com/ftp/products/pattern\lpt.......Length
    > | 7,643,028 took about 35 mins to download at 3.60 - 3.65Ks
    > |
    > | Sophos, Wget www.sophos.com/tools/sav32sfx.exe Length 7,486,008 took about
    > | 33 mins to download at 3.60 - 3.71Ks
    > | Sophos, Wget www.sophos.com/downloads/idi/web_ides.exe.......Length 274,597
    > | took about 3 mins to download ar 3.59Ks
    > | Sophos, Wget www.sophos.com/tools/esdz.exe.......Length 7,369,105 took about
    > | 32 mins at 3.65Ks.
    > |
    > | Performed clean boot and rebooted in normal mode.
    > | McAfee:
    > | c:\AV-CLS\McAfee\update.ini not opened for READ, error code [1]
    > |
    > | Trend:
    > | c:\AV-CLS\Trend\pattern.text not opened for READ, error code [0]
    > |
    > | Sophos:
    > | Working/Scanning (hooray), found a virus fragment 'w95/Sledge-A in file
    > | c:\WINDOWS\system32\ActiveScan\pskavs.dll Removal successful.
    > |
    > | Performed clean boot and rebooted in F8 safe mode.
    > | McAfee: Same error message.
    > |
    > | Trend: Same error message.
    > |
    > | Sophos:
    > | Sophos scan files were not found. The computer shuts down so you can obtain
    > | files in normal mode.
    > |
    > | Am I the only one having these kind if problems with AV-CSL?
    > | Please help me!
    > |
    > | As this is is a non-virus related issue please advise also if should visit
    > | another newsgroup/forum.
    >
    > You are the only one experiencing problems :-(
    >
    > --
    > Dave
    > http://www.claymania.com/removal-trojan-adware.html
    > http://www.ik-cs.com/got-a-virus.htm
    >
    >
    >
Ask a new question

Read More

Windows XP