Luv2Lafmcc

you are correct, I am scanning the Networked drive presented to my laptop. There are no unknown network connections, nor is my network open. No one is connected other than me. I have turned off the FTP server. I'll post when i next see the SCR file show up.

nothing. When i do a full drive scan, it locates the infections, cleans them. I run it again and zero infections are found. Then, a few days later, the SCR files start popping up again in the various subfolders. I keep the file view sorted by "date modified" so I can easily tell when its starting up again. Then I just do a full scan. I would LOVE to have a resolution to this.

Hi James. I unfortunatly have N O T been able to remove this pesky issue. It has not spread to any other drive, but when I do a full scan, and eset removes all infections, withing a week or 2, it starts to pop up again. I have even spent the entire evening going thru my folder trees and removing ANY file that wasnt needed. Really pesky issue. James, do you bit torrent?

I would appreciate instruction on how to properly remove this from my NAS. Thank you

Scan Log Log Version of virus signature database: 14485 (20161122) Log Date: 11/22/2016 Time: 9:22:08 AM Log Scanned disks, folders and files: T:\ Log (below has been truncated as its too long to post here on the forum) T:\Mcc2TB\_Utorrents_\2014 movies\Enemy.2013.HDRip.XviD.MP3-RARBG\Photo.scr - Win32/Crytes.AA worm - cleaned by deleting [1] T:\Mcc2TB\_Utorrents_\2014 movies\Locke 2013 1080p BRRip x264 DTS-JYK\Photo.scr - Win32/Crytes.AA worm - cleaned by deleting [1] T:\Mcc2TB\_Utorrents_\2014 movies\Obvious.Child.2014.1080p.WEB-DL.DD5.1.H264-RARBG\Photo.scr - Win32/Crytes.AA worm - cleaned by deleting [1] T:\Mcc2TB\_Utorrents_\2014 movies\Photo.scr - Win32/Crytes.AA worm - cleaned by deleting [1] T:\Mcc2TB\_Utorrents_\2014 movies\Prisoners 2013 CAM x264 AC3 UNiQUE\Photo.scr - Win32/Crytes.AA worm - cleaned by deleting [1] T:\Mcc2TB\_Utorrents_\2014 movies\Starred.Up.2013.1080p.BluRay.H264.AAC-RARBG\Photo.scr - Win32/Crytes.AA worm - cleaned by deleting [1] Log Number of scanned objects: 83604 Number of threats found: 982 Number of cleaned objects: 982 Time of completion: 12:34:04 PM Total scanning time: 11516 sec (03:11:56) Notes: [1] Object has been deleted as it only contained the virus body.

this seems to be what the current scan is detecting on the NAS : win32/crytes.AA worm hxxp://www.virusradar.com/en/Win32_Crytes.AA/description

Wouldnt the OS of the NAS get scanned by eset and cleaned? Here is info on the NAS i have: Buffalo LinkStation2 Model : LS-WTGL/R1-V3 Firmware Version: 3.10

Maybe source of infection is another machine whioch has got access to NAS files, if so, as long as you don't clean infected machines those files will appear again. It could be virtually anything - including OS on NAS itself. I have done a scan of both my laptop (where eset resides) and the NAS. there are no other computers that access the NAS. I am currently doing another scan of the NAS drive, and will post the scan log. The NAS is 2tb in size, so it take a bit. On the scan of my laptop, no threats found. I would think the if the threats are found only on NAS (T drive) than eset should clean and threat should not come back.

HI I have a NAS that I have scanned and cleaned several times, yet each time, PHOTO.SCR propagates in the folders again. What do I do? eset seems to catch and clean, but is apparently not removing the cause. The infection is only on the network drive, and not on my main computer. Please help.