Critical system errors!

[Temeron]

I started getting a "critical system errors" flashing icon on my computer, right beside the clock. I ran spyware which found a number of virisus and deleted them. Every time I click on the "bubble" it takes me to a website that wants me yo BUY viris protection. I already have that. According to MY spyware the 2 things it won't delete are trojan files.

The names are feeok/johursc.exe in my program files and qrzsyr.dll in my system32 files. I tried to delete them manually but they can't be deleted that way.

Can you help me make this go away? I finally got my computer to actually OPEN a program (it wouldn't most of today). ANY help I can get would be greatly appreciated!

Thank you

Tem

 

[Rik]

Go and read the Viruses/Spyware/Malware, preliminary removal instructions. Follow all the instructions exactly.

Post fresh HJT and AVG Antispyware logs as ATTACHMENTS into this thread, only after doing the above.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

Rik:

Thank you for the help so far. I work nights so I am heading to bed right now. I will do what you suggest when I wake up and let you know what happens. Thanks again!!!

Tem

 

[Temeron]

Rik:

Ok I tried following all the directions. When I get to Download AVG and then try to run it from the desktop it tells me it is a corrupted file? What next?

Thank you

Tem

 

[Rik]

Have 1 more attempt at downloading it and see if it is ok. If not, then we will have to deal with your spyware problems without it.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

Rik:

I tried 2 more times to download and run the AVG. I am getting the same message.

Thanks for all your help so far! I am gettign aggravated, but trying not to

 

[Rik]

OK, don't worry about the AVG scan for the moment. Follow the instructions for posting a HJT log as an ATTACHMENT and we will see about getting your pc working better.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

Rik:

ok here is the log file from the Hijack scan. I can't thank you enough for all your help


Tem

 

[Rik]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

uwasers.exe

Close task manager.


Go to add remove programmes in your control panel and uninstall anything to do with(if there).

WinAntiSpyware 2006 Free


This only a first step as i am still "in training" so please post a fresh HJT log once you have done the above so that i can see if it has been effective.
[EDIT] With luck, AVG antispyware may install after that.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

Rik:

I am not sure I should have done this but I DID do the "remove program" in the control panel and removed the WinAntiSpyware......before you told me to do that last step. It must have worked because when I booted in safe mode and ran through those steps there was nothing in the task manager or the process tab.

Here is the latest HJT log. You are doing GREAT "in training" Thank you again!

Tem

 

[Rik]

Unfortunately it is still evident in your HJT log.

My next suggestion is to click on the run command on your start button menu then type msconfig, then click on the startup tab then take the tick out of anything to do with (if there) -

WinAntiSpyware 2006 Free
C:\Program Files\Common Files\WinAntiSpyware 2006 Free
and all entries that point to uwasers.exe, uwasdc.exe, and uwasdc.exe
(the first 2 steps may mean the third isn't needed)

Then hit the ok button and reboot. Once rebooted it will come up with a message stating that you have made changes with msconfig, just ok the box then create a new HJT log and post it up.

If there is an improvement and/or no more "critical system errors" then it means that WinAntiSpyware is stopped rather than removed. Meaning that there is still some work to do.

Sorry this is taking so long to get on top of but i am doing my best.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

Ok I took the tick out of a uwasers.exe and a uwasdc.exe. There wasn't anything there about WinAntiSpyware at all.

Here is the new HJT Log.

I forgot to tell you the criticzal system errors is still there.



OOPS the HJT file didn't attach, sorry....let me try that again.

Ok I can't figure out why the HJT file won't attach, maybe 3rd time is a charm??

 

[Temeron]

Rik

Here is my latest HJT log. Thanks again for helping me so much. I FINALLY got WinAntiSpyware to refund my money.....


Rose Mary

 

[Rik]

You will be happy to know that your HJT log looks clean but for 1 minor problem.

You are running 2 different virus scanners, this is not a good idea as it can cause conflicts.

You need to uninstall either mcaffee antivirus or AOL antivirus, but NOT both!

If you should have any further problem then post in this thread and i will be happy to help.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

Ok I think I got rid of Mcaffee. Hopefully this is the last time youw ill have to look.

Thank you very much again. You don't know how much I appreciate this.

Rose mary

 

[Rik]

Your log looks fine.


This thread is for the use of Temeron only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[Temeron]

HUGE SIGH of relief! Thank you!!!!

Rose Mary