antipornand eaglesvr

[nisibia]

Last week I installed the software Antiporn! While i was installing, i didn't get any installation process and i thougt there appeared some erro or sth and I throwed the installation file in the trash!

Afterwards I noticed that it has cearly been installed but not in the c:\program~ directory but in the C:\Documents and Settings\Sems\Local Settings\Temp\IXP000.TMP. There I clicked the uninstall file and I installed it, but...

When I restart I see that it's installed again. In the task manager i noticed that the process eaglesvr doensn't show up, while it's actually running and it makes my system really slow.

Now I use Security task Manager with to take process eaglesvr in quarantine to stop it, but I see that in this case the program is installed in C:\Documents and Settings\...\Temp\IXP001.TMP and so in ........IXP002.TMP in the next restart and so...........

I tried ccleaner, spysweeper, etc... to uninstall it but nothing positive happens!

Please help me out of this shit program!

btw, i use McAfee 2007 Suite as protection program but it doesn't give any sign of danger because of this eaglesvr shit!

Please..........

[bobwahler]

The first couple of things that I'd do.
1. Grab the portable version of ClamAV (portableapps.com has one). It doesn't "fix", just identifies problems. But it's another perspective, so to speak.
2. Run a pass with Microsoft's live OneCare scanner http://www.microsoft.com/protect/products/computer/safetyscanner.mspx
Like it or not, it's Bill's system. And he tends to know it better than anyone else.

Both are free.

And remember, porn can not be eliminated; it can only be restrained and dominated ;)

[nisibia]

Thanx a lot but they did not help! It's still running! I can't understand how it reinstalls self again with each restart no matter what i even do!

It always creates a new file in C:\Documents and Settings\...\Temp\ with each restart!

This drive me crazzy, man! Really!

[bobwahler]

Have you tried System Restore? assuming you are running XP and have it enabled.

Try Hijackthis.
It may tell you what's regenerating the file.
Also, Internet options, delete ALL temp everything.
delete everything in your prefetch subdirectory (under \windows)

[nisibia]

I did everything you said and also used hijackthis! With Hijackthis i found sth about Eaglesvr but when I restarted my system it was back, so!? :(

[bobwahler]

Take a look at this.
http://www.file.net/process/eaglesvr.exe.html
Apparently your concern is well founded.

[nisibia]

Yeah, I know this page!

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run I saw once sth related with Eaglesvr and in also HKEY_LOCAL_MACHINE\........\Runonce. I deleted them but with restart they(it) come(s) back!

[Comodore]

It sounds like you have a resuscitating piece of malware. What antivirus program to you use? (You should update all your protection (antivirus and antimalware programs) and run full scans, first off.

Avast! (www.avast.com) has the option to scan on boot to eliminate viruses with resusitators. It may be worth a shot (if you want to uninstall your current protection, if only temporarily). Its free. I also like Avira Antivir's detection rating, so you could also try that. (www.free-av.com) (Obviously, if your current antivirus program misses the problem, it might not be doing its job well, so it may warrant a replacement)

Some other free online scans that might help you:

CA Virus Scan: http://www.ca.com/us/securityadvisor/virusinfo/scan.aspx

CA Malware Scan: http://www.ca.com/us/securityadvisor/pestscan/

Trend Micro HouseCall http://housecall.trendmicro.com/

BitDefender Free Online Scanner http://www.bitdefender.com/scan8/ie.html

McAfee FreeScan http://us.mcafee.com/root/mfs/default.asp?affid=294

Windows Malicious Software Removal Tool http://www.microsoft.com/security/malwareremove/default.mspx

Symantec Security Check http://security.symantec.com/sscv6/d...d=ie&venid=sym

Panda ActiveScan http://www.pandasecurity.com/usa/

---Under this line does not remove, only finds, threats---

Webroot Antispyware Scan: http://www.webroot.com/En_US/land-spysweeper-freescan.html

Kaspersky Free Virus Scan http://www.kaspersky.com/virusscanner (Seems to be too sensitive)

Prevex free scan: http://info.prevx.com/downloadcsi.asp

Also, try posting a hijack this log in this thread for some more advanced troubleshooting.

Good luck!

--The Comodore

[nisibia]

I did a full scan with Mc-Afee suite 2007 several times! But after each restart this eagle shit is reinstalled!

I don't anymore what to do!

Each time it's installed in
C:\Documents and Settings\Sems\Local Settings\Temp\IXP00x.TMP

with x= 1 or 2 or 3 or 4 or 5 or 6 or 7 or 8 or 9

please help!

[Comodore]

As much as I love McAfee, I know that it- and any other program- can't catch everything. Nothing does. Just run a few of those online scans, different ones!, and see if that works.

Try my other suggestions too!

--The Comodore