.usr files problem

[Novisoft]

Hello,
My computer gets some problems since yesterday. When i double click on
any exe file, a copy of this file is generated with the .usr extention.
Also, many of my programs are running slowly (word, powerpoint, windows
explorer) and others no more works (Ex. Nero express, PCANYWHERE).

I scanned all the system with antivir premium but it didn't found any
virus or worm or something like that.
So, I have proceeded to the format of hdd (c: partition, where windows
xp is installed) and reinstall windows xp but the problem is still
here.

Below more information about my computer :
- Version of XP : SP2 with the latest updates (French)
- Hardware setup : Intel Pentium 4, 2.8 Ghz, 780 Mo RAM,
- Antivirus : Antivir Premium (up to date)
- Softwares : PCANYWHERE, Nero, Macromedia and adobe softwares, office
XP.
- The first time when it happened, windows asked me to insert the xp
cd-rom in order to replace some windows files that have been modified.
I have insert the cd-rom but a message told that the CD-ROM is not the
right one. Few minutes after that, my computer rebooted by itself !

Hope someone can help me.

Thanks,

Lyes

 

[Gerry Cornell]

The usr files extension is used by a number of programmes. Do you have
any listed in this link?
http://www.filext.com/alphalist.php?extstart=^U

Have you checked for spyware?

restore points and not use them as they will contain the virus and put
it
back into your system. Turn off System Restore until cleaning is
finished. Also run your anti-virus with updated definitions in safe
mode. Sometimes you need to run an anti-virus from a floppy and Trend
offer one that can be used.

Create a new folder named Sysclean (e.g., C:\Program files\Sysclean, or
just a desktop folder).
Download Sysclean.com (http://www.trendmicro.com/download/dcs.asp) and
place it in this folder.

Download the latest Controlled Pattern Release zip
(http://www.trendmicro.com/download/pattern.asp, e.g., lpt123.zip) and
extract its contents to the same folder. See the Readme text file for
additional instructions.

Delete Temporary Internet Files (IE Tools>Internet Options>General)
accepting the option to delete all offline content. Reboot and delete
contents of all TEMP folders and then your Recycle Bin.

Close all running programs including your anti-virus application, go
offline, and run Sysclean. For best results, do nothing with the machine
until the scan completes.

If the scan shows any infections in System Restore files and you're
running WinXP, create a new Restore Point
(Start>Programs>Accessories>System Tools>System Restore), then delete
all but the most recent Restore Point (Start>Programs>Accessories>System
Tools>Disk Cleanup>More options).

Work through the spyware removal programmes etc in turn in safe mode
until you get no results.

Afterwards, update your own anti-virus application and perform another
full system scan.

Finally run HijackThis and post the HijackThis log to the HijackThis
forum here:
http://aumha.net/

You will need to register with Aumha to be able to post.

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[Novisoft]

Hello,
Thanks for your reply.
I found the virus name but i couldn't remove it with norton 2005 ! I
also used antivir premium but no one of them found the virus.

Here is the informations about that virus :

http://tinyurl.com/cfmhv

Any idea ?

 

[Gerry Cornell]

Novisoft

Did you run the anti-virus scan in safe mode after turning off System
Restore in normal mode?

--


Hope this helps.

Gerry
~~~~~~~~~~~~~~~~~~~~~~~~
FCA

Using invalid email address

Stourport, Worcs, England
Enquire, plan and execute.
~~~~~~~~~~~~~~~~~~~~~~~~
Please tell the newsgroup how any
suggested solution worked for you.



~~~~~~~~~~~~~~~~~~~~~~~~

 

[S. Taylor]

Did you disable system restore as that page instructs and
run Norton AV in safe mode to remove it?

 

[Novisoft]

Hello,
I finally fixed the problem by using Mcafee virus scan. It detects the
virus (Norton and antivir didin't) but couldnt clean the infected
files. So i deleted all of them. The infected files are .exe only +
..usr (generated by the virus everytime a .exe is ran)

Thank you very much for your help.

Lyes