TechSpot

another program is currently using this file - ugly virus

By bluesman3df
Sep 9, 2006
Topic Status:
Not open for further replies.
  1. I can't access any program from control panel it gives this error message "another program is currently using this file" also there are many weird pop-ups, also Mcafee Anti-Virus didn't detect this virus, will you please help me, am stuck I can't get rid of from it.

    Here is my HJT log file
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    Hello and welcome to Techspot.

    It appears you`re not running any antivirus or firewall software. If this is the case, you should get some ASAP.

    Download and install the free AVG antivirus programme and either the free Zonealarm or Kerio firewall programmes. You can get them HERE, HERE and HERE.

    Install whichever firewall you chose, followed by AVG and reboot your system the required number of times. Run the AVG updates.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Run a full system scan with AVG and delete whatever it finds.

    Reboot into normal mode, turn system restore back on and rehide your protected OS files.

    Then, go HERE and follow all the instructions exactly.

    Post fresh HJT and Ewido logs as attachments into this thread, only after doing the above.

    Regards Howard :wave: :wave:

    This thread is for the use of bluesman3df only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  3. bluesman3df

    bluesman3df TS Rookie Topic Starter

    I did same what you request, also I attached hijacked logs. down you can find the ewido report

    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 9:46:01 PM 9/11/2006

    + Scan result:



    C:\Documents and Settings\Qais Rheza\My Documents\Downloads\Ewido Anti-Spyware 4.rar/Patch.exe -> Not-A-Virus.Hacktool.Crack : Ignored.
    C:\Documents and Settings\Qais Rheza\My Documents\Downloads\Ewido Anti-Spyware 4\Patch.exe -> Not-A-Virus.Hacktool.Crack : Ignored.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Rheza\Cookies\rheza@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    C:\Documents and Settings\Rheza\Cookies\rheza@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@ehg-foxmovies.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Rheza\Cookies\rheza@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
    C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\WINDOWS\system32\rundll32.exe -> Trojan.Small.js : Cleaned.


    ::Report end
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 25,948   +19

    You still have not installed any antivirus or firewall software.

    You haven`t followed the instructions properly in the link I gave you. You should do so.

    You need to rename HijackThis.exe to HijackThis1991.exe.

    Post a fresh HJT log only after doing the above.

    Regards Howard :)

    This thread is for the use of bluesman3df only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
  5. bluesman3df

    bluesman3df TS Rookie Topic Starter

    Howard!

    Am using ewido, I reboot to safe mode then I made full scan and i found the virus that controlling rundll32.exe it's called (Trojan.Small.js) after I deleted from ewido the control panel program didn't work because rundll32.exe was missing then I download it online. Now my PC works perfectly. Am going to install Mcafee today for full protection. Thank you so much for your advices, because I didn't know that the safe mode will make the virus disactive.

    thank you again part!
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.