another program is currently using this file - ugly virus

[bluesman3df]

I can't access any program from control panel it gives this error message "another program is currently using this file" also there are many weird pop-ups, also Mcafee Anti-Virus didn't detect this virus, will you please help me, am stuck I can't get rid of from it.

Here is my HJT log file

 

[howard_hopkinso]

Hello and welcome to Techspot.

It appears you`re not running any antivirus or firewall software. If this is the case, you should get some ASAP.

Download and install the free AVG antivirus programme and either the free Zonealarm or Kerio firewall programmes. You can get them HERE, HERE and HERE.

Install whichever firewall you chose, followed by AVG and reboot your system the required number of times. Run the AVG updates.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

Run a full system scan with AVG and delete whatever it finds.

Reboot into normal mode, turn system restore back on and rehide your protected OS files.

Then, go HERE and follow all the instructions exactly.

Post fresh HJT and Ewido logs as attachments into this thread, only after doing the above.

Regards Howard :wave: :wave:

This thread is for the use of bluesman3df only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[bluesman3df]

I did same what you request, also I attached hijacked logs. down you can find the ewido report

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 9:46:01 PM 9/11/2006

+ Scan result:



C:\Documents and Settings\Qais Rheza\My Documents\Downloads\Ewido Anti-Spyware 4.rar/Patch.exe -> Not-A-Virus.Hacktool.Crack : Ignored.
C:\Documents and Settings\Qais Rheza\My Documents\Downloads\Ewido Anti-Spyware 4\Patch.exe -> Not-A-Virus.Hacktool.Crack : Ignored.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Rheza\Cookies\rheza@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Rheza\Cookies\rheza@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@ehg-foxmovies.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Rheza\Cookies\rheza@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@yadro[2].txt -> TrackingCookie.Yadro : Cleaned.
C:\Documents and Settings\Qais Rheza\Cookies\qais rheza@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\WINDOWS\system32\rundll32.exe -> Trojan.Small.js : Cleaned.


::Report end

 

[howard_hopkinso]

You still have not installed any antivirus or firewall software.

You haven`t followed the instructions properly in the link I gave you. You should do so.

You need to rename HijackThis.exe to HijackThis1991.exe.

Post a fresh HJT log only after doing the above.

Regards Howard

This thread is for the use of bluesman3df only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[bluesman3df]

Howard!

Am using ewido, I reboot to safe mode then I made full scan and i found the virus that controlling rundll32.exe it's called (Trojan.Small.js) after I deleted from ewido the control panel program didn't work because rundll32.exe was missing then I download it online. Now my PC works perfectly. Am going to install Mcafee today for full protection. Thank you so much for your advices, because I didn't know that the safe mode will make the virus disactive.

thank you again part!