miekiemoes

Popups generated by the Messenger Service are easy to determine - It says "Messenger Service" on top of the popup

Yes, the Messenger Service is disabled by default in Windows XP SP2. In XP (no service packs) and XP SP1, it's enabled by default.

a first Trojan is located under C:\windows\smgr.exe a second one is located under the other partition: E:\documents\local_settings...\temp\9029000.exe (the serial number is different at each 'clone' appearence) Do you have your system variable for %temp% pointing to your E:\ drive? You can easily find out if you go to…

Also look if C:\WINDOWS\avp.exe is present and delete it, because that process is responsible for "respawning" the C:\windows\smgr.exe. If I am not mistaken, bitdefender should flag and delete that file as well.. However, if the avp.exe is present and bitdefender doesn't flag it, it's a good idea to attach the file here…

If you receive popups all the time isn't that mostly due that the messenger service is running? The Messenger Service is disabled in XP Service Pack 2. If you're getting popups all the time, it's simply because your system is infected

Popup blockers are only blocking popups (if possible)... If you're getting popups all the time, then you have to take away the cause instead of blocking the popups. For that, it's a good idea to let Bitdefender perform a full scan in Windows Safe mode and let it delete everything it is finding as infected.

Niels, are Heuristics enabled in Dr Web CureIt? If I am not mistaken, when heuristics are enabled, and the other settings are set to default in DrWeb CureIt, it won't remove the file, only report it. In anyway, it's a good idea to send the Vsserv.exe sample to vms AT drweb.com with a note that this is a FP, so they can fix…

Hi Ronnieboy, Cannot find 'file///c:/program/msn/msncoreFiles/msn.exe' make sure the path or Internet address is correct. I see from your HijackThislog that the reference to your startpage is set to this: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\ProgramFiles\MSN\MSNCoreFiles\msn.exe which…

Yes, you're right about the Trojan detection here, but I guess there's maybe a reason why the "Trojan" name is included. Imho BD is quite precise in detection here: Trojan.Bat.HDkill.A Trojan.Crack.Stylexp.B Trojan.Activcrk.A Better than a general "riskware" detection. But, I agree that for example Riskware.Crack.Stylexp.B…

it doesn't make sense to have clean files labeled as trojans and deleted, when they're in fact not I didn't say to have them labeled as Trojans. I did say to have them detected - and in this case as an unwanted tool/application/riskware. By default, such detections are not removing the files - it's users choice. As I said…

I think BitDefender just doesn't want users to have any kind of crack... This information should be kept confidential anyway, and it's the users choice. Therefore, telling me that some files have a virus when they do not is biased information trying to influence users. Imho, cracks/keygens whatever should be detected by…

I am sorry to hear that this didn't solve your problem. Already tried to enable the Asus splash screen again? There's a regfix present at the page I gave you previously to "restore"/enable the Splash screen (but I guess you already tried this). Anyway, it's just a matter of what's starting up with Windows/loading order.…

You're welcome. Let us know if that solved your issue

See my post above - I edited my post with the link. That explains it. You'll also see another workaround to fix it instead of re-enabling the splash screen.

Hang on, I think I've seen this issue before with Asus Probe, seems this is a common issue as well. It has something to do with the Splash Screen for Asus Pro which is disabled. Let me see if I can still find the link - I think I have it bookmarked somewhere. It also contains a solution. Edit.. Found it:…

Actually, now I think of it -- If Bitdefender already blocks the svchost.exe from connection on port 1900 with UDP protocol by default and this when the service SSDP service has started.. Maybe that explains why the icon is not showing - because it causes a "freeze" ? Because as I said previously, I was having the same…

Cris, connection on port 1900 with UDP protocol. So I'm almost 100% sure that this service can be turned off without any problems. Yes, because when it's enabled, it *can be a security threat. You may want to read this: http://www.grc.com/unpnp/unpnp.htm This will give a better understanding of what it does and why so many…

I always thought that it has something to do with the options to always display or never display the icon near the system clock Normally yes - that's the first option you should check when an icon is not appearing while the related process(es) are running. But as you see, even though all icons are set to visible, the…

What I read that it only helps for plug and play devices and not for icons of programs. Actually it does "interfere" with icons loading, since in some cases, the SSPD service actually "freezes" the systray when you start up Windows. This is only for a couple of seconds, but when an icon wants to "load" the same time, it…

Hi, Read here for more info: http://support.microsoft.com/kb/323713 Well, you can still test it though, disable the SSDP, restart your computer and see if that solved the "missing icon" problem. If so, you can still enable SSDP - but now you will know what the cause is.

Some people do have problems with one or more icons not loading/appearing in the system tray. The problem can be caused by the Simple Service Discovery Protocol (SSDP) which discovers Universal Plug and Play devices on your network. More info and resolution here: http://support.microsoft.com/kb/841571/ So disable the SSDP…

As i said i'm not a pro but my simple solution should work for deleting the file. If it's indeed Trojan.Agent.AVQ... then, this won't work. Not only because this file is loaded under explorer.exe and winlogon.exe, (some variants are loaded under svchost.exe as well), but also because a related driver is locking the file.…

It's indeed one of these flashdrive infections. More info here. So make sure Bitdefender also removes the infected files from your flashdrive(s) - this to prevent you're infecting other computers with it. Also look in the registry if there are still references to the "MS32DLL.dll.vbs". Especially under the…