i need help again. yeaterday the pc popped up with virus, my son said he just pressed delete. i checked on avast and the web shield had picked up on 2 infected sites and the standard shield on 1 file. i ran ad aware, venus spy trap, ewido spybot and avast. i have again just ran them an ad aware has picked up SpywareNo files in teh SystemVolume Restore and regData, in my destktop, also a WinAd file in Sytemvolume Restore.
thanks
What is the file path of this file, as you say it is part of adsl modem drivers. It should be in programme files, if it is in the system folder then upload the file to Jotti to check it out . Unfortunately I no longer use adaware so can’t help you in that area
Hi marieandgordon,
Adiras is a normal start up executable, read here:http://castlecops.com/s125-Adiras.html
You could consider to provide a hijackthis file, to see what it at the root of your problem.
polonus
system
May 23, 2006, 10:20pm
4
Here is my log file, i also checked the log viewer for avast and the culprits yesterday were a vbs malware in a web site address, jsgummy in documents and settings application data zip file and win32 lager s in a programme file pesttrap. i stopped pest trap from hijack this but it could still be there somewhere!
i will have to post in 2 goes as its saying i am exceeding max length
Logfile of HijackThis v1.99.1
Running processes:
system
May 23, 2006, 10:20pm
5
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gb10.hpwis.com/ http://srch-gb10.hpwis.com/ http://srch-gb10.hpwis.com/ http://srch-gb10.hpwis.com/ http://www.tiscali.co.uk/ http://gb10.hpwis.com/ http://srch-gb10.hpwis.com/ http://srch-gb10.hpwis.com/ http://srch-gb10.hpwis.com/ http://gb10.hpwis.com/ http://www.tiscali.co.uk/broadband/ http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab http://go.microsoft.com/fwlink/?linkid=39204 http://musicmix.messenger.msn.com/Medialogic.CAB http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab http://by109fd.bay109.hotmail.msn.com/resources/MsnPUpld.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140163613896 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140163578630 http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab http://www.sibelius.com/download/software/win/ActiveXPlugin.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
Hi marieandgordon,
Your hjt log has been analysed here, and can be found here for three consequent days from now: http://www.hijackthis.de/logfiles/5bf0e8c242f910147eeb8c0c01ae265a.html
At a first glance see if this is a safe plug-in: -http://www.sibelius.com/download/software/win/ActiveXPlugin.cab http://www.snapfiles.com/dlnow/rdir.dll?id=107693 But I think it is safe.
polonus
sibeleus is something my son downloaded for his gcse music, but thats been on ages. i have just ran hijack again and looked at my task manager, this adiras is not running at all now, but my internet etc is obviously still connected, any ideas?
Hi marieandgordon,
To check up further on all that you have running just download Process Explorer from here, to analyze the situation further:http://www.sysinternals.com/Utilities/ProcessExplorer.html
You can get that latest version of Sun Java from here:http://www.java.com/en/download/manual.jsp
Remove further previous versions, because in case of a Javascript flaw or a in a previous version this is run, and you can get a drive-by infection or repeated trouble.
The best policy furthermore is to run a safer browser like Firefox with the NoScript add-on installed. You can then decide when you have to lower the visors of NoScript and allow Javascript only then when you trust the site. To know if a search result can be really trusted you can either have siteadvisor installed (green is safe) on either IE or FF, or do you searches throughhttp://www.scandoo.com .
Stay secure and surf safe,
polonus
Looks nice and clean, but as Polonus says you must uninstall the old java first ;D