Ask Experts Questions for FREE Help !
Ask
    citroes's Avatar
    citroes Posts: 2, Reputation: 1
    New Member
     
    #1

    Feb 2, 2005, 12:38 AM
    Issas.exe, iau.exe etc how to get rid of?
    Hi

    Whenever I try to open a text file, the following files load onto my machine:

    Lssas.exe, iau.exe, mservice.exe, svshost.exe, msqdevl.exe and stisvsq.exe

    Its easy enough to remove them again with Hijackthis run in safe mode, but I cannot use my notepad anymore. Whenever I open the notepad or a *.txt file, these files end up on my hard drive in the Windows directory and registry.

    Can anyone help?

    Thanks
    fredg's Avatar
    fredg Posts: 4,926, Reputation: 674
    Ultra Member
     
    #2

    Feb 2, 2005, 04:35 AM
    Worm
    Hi,
    You can read about this Worm here:

    http://www.trendmicro.com/vinfo/viru...WORM_AGOBOT.RL

    Your computer is infected with spyware/malware, and it will keep "rebuilding" itself until you get rid of its files, also clear it from the Registry.

    Here are steps that should get rid of it:

    If you think you already have Spyware/Advertising Ware in your computer, run these as follows:

    http://www.security-related.com/download2.htm
    Download: SpyBot Search & Destroy; 1.3

    AdAware at:
    http://www.lavasoftusa.com
    Download: AdAware_SE

    CWShredder at:
    http://www.download.com/CWShredder/3...ml?tag=lst-0-1
    (CWShredder is intended only for removal of CoolWebSearch files; placed as spyware on the harddrive). It is not a "stand alone" scan, but needs to be run.

    All 3 of the above programs run better and much faster when run in SafeMode.

    To get into SafeMode:
    Re-boot the computer, and immediately after starting up, Press and hold down, F8, at top of keypad.
    When the options show on the screen, use the up and down arrow keys on the keyboard to select
    "Safe Mode".
    Press Enter

    It's best to run the AdAware scan first; 3 times; then re-boot.
    Then, run the AdAware scan again 3 times; then run the SpyBot. Then, run CWShredder.
    Re- Boot.
    Reason for running so many times:
    Some of these trojans' files can be deleted the first time; leaving some others; but on re-boot, they re-write the files that were deleted.
    Running multiple times deletes most of it the first
    Time.

    If you wish to have a great program, after you clean out Spyware/Advertising Ware:
    SpyWare Blaster 3.2
    Great, free, program that STOPS spyware, trojans, home page hijacks, etc, BEFORE they get into your computer. Check it out at CNET at link:

    http://www.download.com/SpywareBlast...ml?tag=lst-0-2

    Two Tips:
    If you notice the little green computer lights that show your dial-up connection to the internet staying on when they shouldn't be, located on the bottom right of the system tray, disconnect immediately and run AdAware. These lights staying on means that some URL is sending or receiving spyware/advertising ware to or from your computer, most of the time.

    Other Tip: After being on the net, if you have visited any sites you don't really trust, then run AdAware BEFORE you shut down or re-start the computer. This will delete any Spyware easier, before the computer can configure it, set it up, spread it throughout the Registry, and make it more difficult to remove after re-booting.

    Best of luck,
    fredg
    citroes's Avatar
    citroes Posts: 2, Reputation: 1
    New Member
     
    #3

    Feb 2, 2005, 06:24 AM
    I have all those utilities already
    I have ad aware, spybot, hijack this, about buster and cwshredder and I've run them all. Like I said - I can clear those files off easily enough, by physically deleting them from the Windows directory and by running hijack this in Safe Mode. Yet whenever I try to use my notepad it comes back. ONLY when I use my notepad does it come back. After I've run all the utilities I've mentioned and I've deleted the files it is GONE - I run the spyware utilites again and it is CLEAR, until the next time I open the notepad.

    Its as if it has somehow hijacked the notepad and rebuilds itself when I try to use the notepad to create a txt file.
    SESaskDFC's Avatar
    SESaskDFC Posts: 214, Reputation: 17
    Full Member
     
    #4

    Feb 2, 2005, 06:56 AM
    Howdy:

    The other expert gave good advice but they got the wrong trojan/worm..

    The removal will need to be done manually..

    http://www.qdeck.com/avcenter/venc/d...asysearch.html

    Murray
    fredg's Avatar
    fredg Posts: 4,926, Reputation: 674
    Ultra Member
     
    #5

    Feb 3, 2005, 06:16 AM
    Trojan
    Hi, again,
    After more thorough research, what you have is called a Trojan Dropper.
    It affects Notepad!

    Here is a link to symantec and how to get rid of it:

    http://securityresponse.symantec.com...n.dropper.html

    Best of luck,
    fredg
    razor42069's Avatar
    razor42069 Posts: 1, Reputation: 1
    New Member
     
    #6

    Apr 23, 2005, 04:43 PM
    I got the same but its gone deeper?
    I got the same trojon doppler but...
    I have removed the infected stuff
    I can't get to some web pages
    Like :
    http://www.symantec.com/
    Or Microsoft download pages
    And the list goes on...
    Also this thing has messed up my norton sytemworks file
    I have tried to reload norton and I just get errors?
    It seems to me that the makers of this T.D.
    Have also got something else hidden in my cpu
    Any body got any good ides?
    Thanks in advance

Not your question? Ask your question View similar questions

 

Question Tools Search this Question
Search this Question:

Advanced Search

Add your answer here.



View more questions Search