NIS 2009 keeps saying it has blocked the "downloader" virus. It does this everytime on reboot, when on internet, etc. I have tried various things to get rid of this such as:
-Ran scan using Malwarebyte's Anti-Malware
-Scan using Super Anti-Spyware
-Panda online scan
Each one found something and it was cleaned but NIS still pops up stating it blocked it. I have been through my registry, run many cleanings, and went thru steps found in similar posts in this forum. Cannot get this thing to go away.
I originally thought it was a startup item called "Taskman" which points to c:\windows\system32\taskmanegr.exe. However, I re-named the file and removed from startup group and still get virus message.
Can anyone take a look at my HiJackThis log file and help me destroy this thing!
NIS 2009 keeps saying it has blocked the "downloader" virus. It does this everytime on reboot, when on internet, etc. I have tried various things to get rid of this such as:
-Ran scan using Malwarebyte's Anti-Malware
-Scan using Super Anti-Spyware
-Panda online scan
Each one found something and it was cleaned but NIS still pops up stating it blocked it. I have been through my registry, run many cleanings, and went thru steps found in similar posts in this forum. Cannot get this thing to go away.
I originally thought it was a startup item called "Taskman" which points to c:\windows\system32\taskmanegr.exe. However, I re-named the file and removed from startup group and still get virus message.
Can anyone take a look at my HiJackThis log file and help me destroy this thing!
I am running a Windows Home Server so it may have turned it off since it handles backups regularly.
Here is my HiJackThis log:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 3:43:03 PM, on 5/1/2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18226) Boot mode: Normal
Aren’t you supposed to be able to see Risk details in Security History under Resolved/Unresolved Security Risks, the location of the malicious file being one of them?
As for the questions.......yes, i did definition updates before the scans..........and the location shown in NIS is always c:\windows\???? (the file name is always different.....the last one found was c:\windows\jdeadss.exe...one before that was c:\windows\asvemdsaemaory.exe....if i go and try to find these they do not exist, even with hidden files shown).
As for the questions.......yes, i did definition updates before the scans..........and the location shown in NIS is always c:\windows\???? (the file name is always different.....the last one found was c:\windows\jdeadss.exe...one before that was c:\windows\asvemdsaemaory.exe....if i go and try to find these they do not exist, even with hidden files shown).
The reason suspected to why you cannot find these files is because it's after the fact, something is downloading these files in the "Windows" folder and Norton grabs them, then you go and look but Norton has already grabbed them.
Kaspersky online scan finished and found nothing. I rebooted and as soon as Windows comes up I got another “downloader” blocked message…this time it was c:\windows\asvemdsaemaory.exe (which if searched out does not exist…even with all files set to show)
Have you tried disconnecting from you LAN, then once you see it is clean, restart your PC and see if the problem happens again, when connected to no other PC.
2) Used ClamWin cause it's free and I don't have anything else to use. Alot of other free ones don't work well on WHS.
3) The WHS box is connected to a router with the rest of the computers which gain outside access via cable modem.
4) I have not tried disconnecting from LAN. That will be my next step.
Problem is weird. The only time I have gotten a virus message for most of the day is right after reboot. Almost like NIS stops a service and it is started again upon boot.
I'm still not sure on the internet connection; are the 'workstations' hooked to the router or just to the server? If everything is hooked to the router, hhmmm
But if the server is the only physical connection to the router and then the others connect to the server only, I would try and get something stronger than ClamWin (even a trial version would do) to scan the server with.
Also you can try this; right before you shut your system down, unplug the network connection from the system then shutdown. When you start back up do you see the virus message then?
This is what I have done so far.......I rebooted just to make sure the message was still coming up. After a few minutes after reboot I got it to show. NIS 2009 blocked it. I then unplugged the workstation from the network and rebooted. Left it overnight and have had no message yet.
However, I plugged the cable back in and rebooted just to see if the message would come back. So far, I haven't received another message. Not sure what has happened to cause it to stop. I downloaded Avast WHS edition trial and scanned the server. It did not find anything and is monitoring it actively.
(Answer to your earlier question is the router has all machines plugged into it and all access the net through the router.)
I'm not sure if there is anything further I can do at this time. If the message comes back I will post again.
Thanks for the help. Let me know if there are any other actions to be taken.