Cws.Searchmeup

Discussion in 'privacy problems' started by Gigabyte, Jan 14, 2006.

Thread Status:
Not open for further replies.
  1. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    My antivirus is picking up this as a virus,eventhough it's adaware. The thing is,I don't have any kind of the problems associated with these kind of adaware programs. Any ideas? Thanks
     
    Gigabyte, Jan 14, 2006
    #1
  2. Snowie

    Snowie Guest

    Snowie, Jan 14, 2006
    #2
  3. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    snowbound, Jan 14, 2006
    #3
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Please only use the Scan Only option of CWShredder.
    If it finds anything post back with the results before letting it remove anything.

    Regards,

    Pieter
     
    Pieter_Arntz, Jan 14, 2006
    #4
  5. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    Already had run CWS shredder.:D Nothing was found. I am using Panda Internet Security.
     
    Gigabyte, Jan 14, 2006
    #5
  6. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    Here's what I get when I do a scan...

    Adaware/cws.searchmeup
    location: c:\recycler\s-1-5-21-3728851586-282846505-3676742289-1009\dc2.exe
     
    Gigabyte, Jan 14, 2006
    #6
  7. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Does your anti-virus scan result show a file or registry location ?
     
    Bubba, Jan 14, 2006
    #7
  8. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    No. Just what I posted above.
     
    Gigabyte, Jan 14, 2006
    #8
  9. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    lol....sorry....I posted soon after you did :blink:

    It does appear those entries are in the recycle bin :doubt:
     
    Bubba, Jan 14, 2006
    #9
  10. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    The only other thing that it tells me is that it couldn't delete the file(which it usually does) and to make sure it's not in use or protected. I don't see it running in my apps. It also comes up as vbstub.exe
     
    Gigabyte, Jan 14, 2006
    #10
  11. Snowie

    Snowie Guest

    Snowie, Jan 14, 2006
    #11
  12. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    snowbound, Jan 14, 2006
    #12
  13. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    From snowbounds link...."vbstub.exe is a process which is registered as the Agent-EN Trojan."

    From Sophos concerning Troj/Agent-EN...."Troj/Agent-EN may create files named system16.exe, system.exe, systemup.exe and vbstub.exe.
     
    Bubba, Jan 14, 2006
    #13
  14. Snowie

    Snowie Guest

    *****Use Device Path Exerciser
    The Device Path Exerciser (dc2.exe) utility provided with the Windows DDK is an expanded version of the Device Path Exerciser that is part of the Windows Hardware Compatibility Tests (HCT). *****



    http://www.microsoft.com/whdc/driver/security/code-cover.mspx



    Regards To All

    Snowie The Snowman
     
    Snowie, Jan 14, 2006
    #14
  15. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    Gigabyte, Jan 14, 2006
    #15
  16. snowbound

    snowbound Retired Moderator

    Joined:
    Feb 18, 2003
    Posts:
    8,723
    Location:
    The Big Smoke
    snowbound, Jan 14, 2006
    #16
  17. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    Gigabyte, Jan 14, 2006
    #17
  18. metallicakid15

    metallicakid15 Registered Member

    Joined:
    Dec 6, 2005
    Posts:
    454
    you can always try a2 or ewido
     
    metallicakid15, Jan 14, 2006
    #18
  19. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    ewido didn't find anything.
     
    Gigabyte, Jan 14, 2006
    #19
  20. controler

    controler Guest

    controler, Jan 15, 2006
    #20
  21. snowie

    snowie Guest

    CON

    how you doing.....nice program you suggested........got a feeling that he has a FP.........perhaps updated one or another of his programs (anti virus etc) an the update caused the FP............will wait and see.



    regards
     
    snowie, Jan 15, 2006
    #21
  22. Gigabyte

    Gigabyte Registered Member

    Joined:
    Apr 28, 2004
    Posts:
    163
    Location:
    NC,USA
    Regrun found legetimate files. No viruses/trojans.
     
    Gigabyte, Jan 15, 2006
    #22
  23. dfgfg

    dfgfg Guest

    dude, go into sys36 and arrange by modified, inspect those any funny names, and remove them to recycle bin! dont delete them YET!, i'm excepting u to know some about puter.

    my fault! go into windows.. chnage view to modified remove funny, and do the same in system32 folder also check downloadprogramfiles folder remove some those to.

    Gigabyte, are u a themer.. did u do a theme for firefox?

    My guess is that it was saved by system restore. thats where they're getting em?
     
    Last edited by a moderator: Jan 15, 2006
    dfgfg, Jan 15, 2006
    #23
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...