Acronis Privacy Suite 9 - Outsmarted!

Hi,

I am posting here as acronis support web form will not let me select 'product' for support.

I have just registered and downloaded Acronis Privacy Suite 9 ( build 1.429)
as I have some viruses/malware which could not be removed by AVG (although identified)

Acronis has not been able to identify or remove the offemding viruses/malwares which can regenerate themselves after being deleted.

I purchased Acronis as I believed the virus maybe a 'root kit or 'cloaked' virus..whatever it is acronis cannot find or remove it.

How can I (we) find out what it is and how to remove it.

Descrption of knowns

1) avg boot scan reports a virus infected file called installer.exe in c:\
it can't be removed.


2) some processes in systray appear to be suspicious e.g

Ueid & mouspad8 the Ueid.exe in c:\ cannot be deleted and is being used by windows..I don't usually see these are they windows files or viruses?

3) avg reports c:\windows\ss1001.exe as virus
also c:\windows\DRSMARTLOAD46.EXE
c:\windows\TEMP\!UPDATE.EXE

THESE ARE REMOVED BUT COME BACK!

4) system very unstable and lots of popups

Please help

Regards

N Kilner

 

First - if on, switch off system restore and reboot computer. Some nasties if captured in the sys restore (XP) system manage to keep spawning themselves back into ram and then back onto the 'live' system.

Second at the run menu off of the start button, type services.msc - look through all the entries for files that are set to automatically start with names like the ones above or any that look strange - set them to manual temporarily.

Third type in msconfig and check for any strange sounding files or files whose paths seem strange under both tabs STARTUP and Wndows. Untick strange ones.

Fourth - reboot into safe mode and see if you can manually find the files mentioned in your post and delete them permently not to the rubbish bin.

Check the c:\wind\temp file and after enabling view all files including system files - look in the doc&settings folder with your log on name - there will be another temp folder here - delete as many files from here that windows will allow - unless you see a file you know you want and is safe.

Fifth - reboot windows and see how you go. If OK then and no program complains that it hasn't been started or more likely fails to start such as not being able to get onto the interent or that sor tof thing - then all should be right.

Colin

 

Hello N KIlner,

Thank you for choosing Acronis Internet Privacy and Antispyware Software.

Please create Windows System Information as it is described in Acronis Help Post and submit a request for technical support. Attach the collected information to your request along with the step-by-step description of the actions taken before the problem appears and the link to this thread. We will investigate the problem and try to provide you with the solution.

Thank you.
--
Kirill Omelchenko

 

Hi,

Thanks for your help.

I am using win98 se but managed to resolve the problems manually after a lot of work. The key to solving the problems was our Squid proxy server which logs all web access. I noticed alot of entries linking to exe files on the web. I put access restrictions on the sites listed in the logs. This prevented the adware stuff respawning after deletion. Then I searched my pc using 'find' for files containing links to those files and anything else suspicious and deleted them

That cured about 95% of the infectation but in the process somehow windows got corrupted so I had to do a 'repair' install of win 98.

I have temporarily disabled Acronis for the moment and have been using AD-AWARE and AVG to monitor the situation. I may be being a little harsh on Acronis as I am not familiar with its operation or what it can do. I bought it because of the claims made on the web site but was not impressed by my initial use of the program. I expexted more from a program which is 44mb in size.

I will have another look at acronis and give it another try to see if it is better than the other programs i've used before.

Thanks again for the help.

Nigel

 

Hello Nigel,

Sharing your experience is very much appreciated.

If you have any further experience to share, please feel free to post it on this forum.

Thank you.
--
Kirill Omelchenko