ahmaden

I installed new os , please tell me how to block IRC protocol in eset smart security firewall ? the description says : hxxp://www.virusradar.com/en/Win32_Virut.NBP/description 'The virus connects to the IRC network. It can be controlled remotely. ' so how can I identify which application in eset rules is using IRC protocol ?

beacase i did that before reading your post. i thought eset will move file to quarantine entriely ,didnt know that only infected copy will go to quarantine and the cleaned file remain to its place... dont laugh at me please , when my OS was working properly and i was in eset smart security , when i saw eset quarantine important files in system32 such as svchost.exe , i restored it ! however i tried sysrescue scan again and ~20 files cleaned again , and i tried to boot in os but same error

Nope. Legitimate files were infected with Virut which is a file infector (virus). ESET cleaned the virus from these files and the original infected copy was put to quarantine where malicious files are stored in a safe form so that you could restore them at a later time, if needed for whatever reason. omg ! i tried to restore all files from quarantine then message appeared saying the file already exsit , replace ? ( i pressed yes then same message showing for next file , then i pressed yes again for couple of times , and since i cant do it for 1184 files, in some point i exhausted then i exited sysrescue .... and now im reading your post ... so what shall i do ? scan again ?

marcon , scan log says files quarantined : cleaned - quarantined so i think that means all 1184 files moved from system drive to quarantine folder , so how they can function properly ?!

can i find which one is the main malware that caused all these system files to infect ?

eset sysrescue found 1184 files in : windows/system32 windows/winsxs/ windows/syswow64 and quarantined them . scan log : hxxp://pastebin.ca/3002335

hi maniac , thanks for your post im scanning my pc with eset sysrescue live but as i mentioned above i cant boot in my OS ,since i get error during windows boot 'logon process initialization failure' its because eset quarantined too many files from SYSTEM32 folder , can i restore them from quarantine? (considering i cant boot in in OS ) i tried safe mode but same error is there a way to restore files that eset quarantined without loging in? if there is no way , so how can i recover system32 files ? ( plelease dont recomend new OS installation ) i heard there's a method called 'sfc' (system file checker ) , will it help ?

no im using eset more than a year along with malwarrbyte ARE YOU sure this file wksprt.exe is the one that infected my system now i cant boot in windows i get an error saying 'logon process initialization failure' i tried to boot im safe mode but same error

i exported it to .xml file : 12.5.2015.xml

i paste it in pastebin : hxxp://www.pastebin.ca/3001833

cant paste them in here get an error here saying "post too long "

where i can find threat log ? you mean in tools>log file ? i see around 100 legit files detected by realtime&start up scanner (all of them located in system32 ) can you please help me by remote dekstop or team viewer ?

hi im using eset smart secutiy 7 with latest update i encountered this problem just now , eset quarantine everything in SYSTEM32 and SYSWOW64 folder on the other side i found this problem too , for example when i click on some file picture etc i get following error the parameter is incorrect server execution failed eset even quarantine some legit files like svchost.exe and even some other files that needed for windows boot up . any suggestion for my situation ?

yes I did restart my pc and I still get that error . I will do that metaller btw I bought eset license on retailer website and I didn't have any account on eset website , and after installing eset and getting this error I prompted to register on my.eset.com for disabling anti-theft. thanks .

hello, I want to disable anti-theft but im unable to do it, im using eset smart security 7.0.317.4 I go to 'setup' then I press 'disable permanently' then window pops up and ask me to sign in with 'my.eset.com' account . I created an account on that site then I entered my email/pass , but after clickin on disable I get following error : invalid email address of password (error 0005 ) (I attached sceenshot of error) im sure im entering my account that I created correctly , dont know why it get this error ! is there other way to turn off anti-theft ? thanks.