spyware problem

[arvind123890]

Now a days one problem is arising in many of our clients pc, the problem is that a software called antivirxp08 is getting downloaded and gets installed on the pc. they were already protected with escan, still this type of probs are arising, is there some way to block all this type of spyware attacks

[dattesh]

Hello Arvind,

I found same problem such as Vista Anti Virus 2008 in client machine, but i could resolve with Latest MWAV in safe mode. Even it could remove in normal mode.

I seen Vista Anti Virus named as VAV in program file, it all entries caught by MWAV & removed, further i found in registry vav.exe in various location, it also could be removed.

Hence, such spyware could removed still problem, pls provide me RAD.

[arvind123890]

i mean to say can it be prevented from installing

[tarique]

A)Please download latest spydb.avs from following link
http://update6.mwti.net/pub/update/spydb.avs
And save this file in three location.
1)Go to start>>run type %temp% and save it in this folder
2)<Root Drive>\program files\escan folder
3))<Root Drive>\program files\escan\temp folder

B) Download latest mwav (9.9.7)
http://update6.mwti.net/download/tools/mwav.exe

C) Mwav Setting:
This utility is the self extracting zip format file. After
download just execute/run the mwav.exe file by double clicking on it, then
accept the license agreement, select all the possible options on the screen to scan your system thoroughly such as "Memory/Services","Startupfolder","Registry","System Folder","","ScanSpyware", "Drive", "All Local Drives" and " Scan all Files", then click "Scan& Clean" button.

Note: Requesting you to scan the machine in SAFE MODE.

Before running the MWAV toolkit please see to that the Temporary Internet
Files, Cookies, and the Temporary files are cleared. Also turn off the System
restore option of the machine.
To turn off the system restore option follow the below mentioned procedure for

Windows XP:
1. Right click "My Computer"
2. Click on "Properties", then in that you have a "System Restore" tab.
3. Tick the check box " Turn Off System Restore".
4. Then click on "Apply" then on "OK"
Also enable the "Remote Access File Rights" of escan by following the below
mentioned procedure:
1. Right click the green "e" icon on the taskbar.
2. Click on "Start eScan Content Administrator".
3. In that you have a Tab as "Remote Access File Rights" click on the tab.
4. Tick the check box "Enable Remote Access File Rights"

If the problem persist please send us the MWAV log of the scanning done along
with the pinfect.zip file. The files will be created in the windows temporary
folder.
1. Goto Start>>Run>>%temp% and press Enter
2. This will take you to the Windows Temporary.
3. You will find the MWAV.log file and the pinfect.zip file in this folder.

[arvind123890]

Hello tarique me also woeking for microworld kolkata, and i have already done the following steps and got rid of that problem, but my point was that the software called antivirxp08 gets installed in the system, and its also shown under add or remove programs, inspite of remote access file rights being enabled, it gets installed, so i was asking if there is some way to block it from getting installed in your machine.

[tarique]

Hello Arvind,

You need to remove manually antivirus2008.

1)Boot your machine in safe mode.
2)Open task manger
3)kill three Process like.
rhcauqj0eaft.exe
shc9uqj0eaft.exe
antivirus2008.exe
4)Go to Start>>>>Run>>>regedit
5)press key ctrl+f
6)search antivirus
7)Delete all entry like antivirus2008.exe.
Delete antivirus2008 folder from <Rootdrive>\programfile\antivirus2008
9)Delete rhcauqj0eaft folder from <Root Drive>\programfile\rhcauqj0eaft
10)Delete shc9uqj0eaft folder from <Root rive>\programfile\shc9uqj0eaft
11)Delete antivirus2008 program from Start>>>All programfile
12)There is no need to uninstall from control pannel

Restart your system in normal mode.

This process will be solve your problem.

[dattesh]

Dear Arvind,

This is authenticated software, mean to say user might click on spyware or wallpaper/screensave website & it gets downloaded.

If you do not want to use regedit, you may use free utility Revo Uninstaller
It will remove XP Antivirus & will show all registry entries of XP Antivirus, then select all & Delete.