Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Startup List Item


  • Please log in to reply
9 replies to this topic

#1 62blue

62blue

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:06:50 AM

Posted 25 May 2008 - 01:19 AM

I have a question on one item (so far) in my startup list, usnsvc.exe. Your Startup List page here has seven entries on that file, all bad, yet when I scan the folder containing that file with AVG (fully updated), nothing comes up. It's in C:\Program Files\MSN Messenger.

I'm ready to follow the instructions on the page to remove it, but first I'd like to clear up why AVG doesn't detect it as malware. Any ideas here?

OS: XP Pro, sp2

BC AdBot (Login to Remove)

 


m

#2 OldGrumpyBastard

OldGrumpyBastard

  • Members
  • 781 posts
  • OFFLINE
  •  
  • Location:"Way South of 'da Bridge"
  • Local time:07:50 AM

Posted 25 May 2008 - 01:39 AM

Not all Anti-Virus programs pick up ALL viruses...While AVG is a very good program (I use and recommend it) it may not have this varient in it's data base for whatever reason...You would think that all of these programs would have all of the definitions for ALL Virus applications but in fact they just don't... Another program may or may not pick it up while another still might...Which program do you use? Therein lies the rub....
Does this look like an OldGrumpyBastard or what?

#3 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,030 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:04:50 AM

Posted 25 May 2008 - 02:51 AM

usnsvc.exe. is necessary to run Windows Live Messenger.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#4 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,076 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:07:50 AM

Posted 25 May 2008 - 06:55 AM

Since it's needed for MSN Messenger, it's likely that it's not a virus.

If you'd like further confirmation, submit it to http://virusscan.jotti.org/ for scanning by multiple antivirus engines (there's a Browse button at the top of the page that you can use to submit it).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#5 OldGrumpyBastard

OldGrumpyBastard

  • Members
  • 781 posts
  • OFFLINE
  •  
  • Location:&quot;Way South of 'da Bridge&quot;
  • Local time:07:50 AM

Posted 25 May 2008 - 07:03 AM

Seems odd that it is listed here as a bad thing:

http://www.bleepingcomputer.com/startups/U...rver-21268.html

Maybe it has something to do with where the file is located as to whether it is a problem or not. Probably should do as usasma suggests and have it checked out...
Does this look like an OldGrumpyBastard or what?

#6 usasma

usasma

    Still visually handicapped (avatar is memory developed by my Dad


  • BSOD Kernel Dump Expert
  • 25,076 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:07:50 AM

Posted 25 May 2008 - 07:36 AM

In the case above, the file in question is located in the %system% folder (most likely the C:\Windows\System32 folder on your system)
Since this file is located in C:\Program Files\MSN Messenger it's not likely to be the virus that's mentioned there.

While I'm not a malware expert, here's a couple of things that I've learned in my travels about the web.

When you search for a filename because of a problem, you'll find lot's of stuff listing problems with that filename - but it may not be the same problem as yours.

If you search for the filename and get no results - that's suspicious, but not enough to diagnose it as a virus.

The startup listings that you find with searches will generally concentrate on the bad stuff - that's because the good stuff doesn't usually cause problems.

A file can be a good file in one location and a bad file in another location.

In short, you've gotta take it all with a grain of salt. The http://virusscan.jotti.org scan will scan a particular file with many different antivirus scanners - but the decision is still the user's.
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#7 62blue

62blue
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:06:50 AM

Posted 25 May 2008 - 08:37 AM

Okay, so the location of the file is important, something I didn't look at before on the malware page. Anywhere other than the MSN Messenger folder seems to indicate it's malware, which isn't the case on this computer so I won't bother scanning with other anti-virus programs.

That's a relief, but I've at least removed it from the startup list. Thanks for the replies everyone. :thumbsup:


EDIT: I just did some more checking and found this at http://www.what-is-exe.com/filenames/usnsvc-exe.html :

The exact disk location is also shown below to verfiy it is not spyware, as many spyware programs use similiar names and just locate them elsewhere on your hard drive.


Edited by 62blue, 25 May 2008 - 08:52 AM.


#8 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,030 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:04:50 AM

Posted 25 May 2008 - 08:52 AM

Location is very important, some viruses, maleware, spyware, adware can change the name of files, for this reason it is important to know what the default location of the file is.

There is a good article on the usnsvc.exe that can be read here.

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#9 62blue

62blue
  • Topic Starter

  • Members
  • 26 posts
  • OFFLINE
  •  
  • Local time:06:50 AM

Posted 25 May 2008 - 09:14 AM

Thanks dc3. It looks like we both found that page at the same time. :thumbsup:

#10 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,030 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:04:50 AM

Posted 25 May 2008 - 09:23 AM

Actually...I should have included this when I was looking at it last night and made my first post. :thumbsup:

Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users