Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Partial AV2009


  • Please log in to reply
13 replies to this topic

#1 supermarth64

supermarth64

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 20 December 2009 - 08:34 PM

Hey there. Recently I accidentally downloaded the "trial" version of AV2009 from the internet. Unfortunately, this struck me when my Norton Antivirus expired, so it didn't help me there. I noticed that it appeared and I quickly stopped the download, deleted the file, and force shutdown my comp. This didn't stop it, as every time I turned on the comp, it had that annoying little icon in the lower right hand corner. Whenever I tried to open up IE or Chrome, it was set to that fake "Warning your computer may be infected" (or whatever it said, I forget because it was yesterday's). I couldn't system restore because it was shut down by the virus. However, I managed to speed End Process that and download AVG Anti-Virus Free from Firefox and removed it. I didn't fully scan the first time because I had to go to sleep, but it removed the majority of it. Due to the fact that I canceled the scan, I cannot say what was removed except that it was 184 things and that about 1/3 of them were Tracking Cookies (which are always on my computer).

Afterwards, I installed and ran SUPERAntiSpyware. Like AVG Anti-Virus, I had to stop the scan because of my sleep time. Here's the log of that (removed 2 Trojans, a bunch of Tracking Cookies, and others)

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/19/2009 at 10:45 PM

Application Version : 4.32.1000

Core Rules Database Version : 4379
Trace Rules Database Version: 1978

Scan type : Quick Scan
Total Scan Time : 00:38:06

Memory items scanned : 802
Memory threats detected : 0
Registry items scanned : 533
Registry threats detected : 39
File items scanned : 3053
File threats detected : 57

Trojan.Agent/Gen-FakeSpy[Broad]
[dalqfsjr] C:\USERS\RICHARD\APPDATA\LOCAL\XFCJWO\VJDNSYSGUARD.EXE
C:\USERS\RICHARD\APPDATA\LOCAL\XFCJWO\VJDNSYSGUARD.EXE

Adware.Tracking Cookie
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@ads.nexon[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@tacoda[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@atwola[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@ads.morpheus[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@doubleclick[2].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@advertising[2].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@server.cpmstar[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@collective-media[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@mediaplex[2].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@atdmt[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@apmebf[1].txt
C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Cookies\richard@zedo[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@imrworldwide[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@mediaplex[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ads.pointroll[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@smileycentral[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@www.googleadservices[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@traffic.buyservices[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@tacoda[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@adinterax[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@advertising[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@revsci[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@twci.coremetrics[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@casalemedia[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@specificclick[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@2o7[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@msnportal.112.2o7[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@adfarm1.adition[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ehg-dig.hitbox[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@anad.tacoda[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ehg-standardandpoors.hitbox[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@apmebf[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@perf.overture[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@anat.tacoda[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ads.cnn[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@richmedia.yahoo[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@adopt.specificclick[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ad.uk.tangozebra[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@precisionclick[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@atdmt[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@doubleclick[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ads.online.sh[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@insightexpressai[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ehg-tigerdirect2.hitbox[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@tribalfusion[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@track.searchignite[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@hitbox[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@edge.ru4[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@overture[1].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@statse.webtrendslive[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@questionmarket[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@realmedia[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@fastclick[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@ad.yieldmanager[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@statcounter[2].txt
C:\Users\Jinquan\AppData\Roaming\Microsoft\Windows\Cookies\Low\jinquan@zedo[1].txt

Rogue.Agent/Gen
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#knkd
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#aazalirt
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#skaaanret
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#jungertab
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#zibaglertz
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#iddqdops
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#ronitfst
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#tobmygers
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#jikglond
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#tobykke
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#klopnidret
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#jiklagka
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#salrtybek
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#seeukluba
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#jrjakdsd
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#krkdkdkee
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#dkewiizkjdks
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#dkekkrkska
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#rkaskssd
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#kuruhccdsdd
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#krujmmwlrra
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#kkwknrbsggeg
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#ktknamwerr
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#iqmcnoeqz
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#ienotas
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#krkmahejdk
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#otpeppggq
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#krtawefg
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#oranerkka
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#kitiiwhaas
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#otowjdseww
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#otnnbektre
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#oropbbsee
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#irprokwks
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#ooorjaas
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#id
HKU\S-1-5-21-800008463-1855463372-313719042-1000\SOFTWARE\AVSCAN#ready

After this removal, the icon disappeared from the bottom right. Google Chrome and Internet Explorer no longer went to the fake virus site but rather didn't load at all. Google Chrome gave me an Error 0 error, while IE says that it cannot display the webpage. When I push the Diagnose Connection Problems button, it says that

"www.google.com" is not set up to establish a connection on port "World Wide Web service (HTTP)" with this computer.

I then went to sleep.

Today, I went ahead and installed Malwarebyte' Anti-Malware and I did a scan. It came up with this:

Malwarebytes' Anti-Malware 1.42
Database version: 3289
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18865

12/20/2009 1:41:21 PM
mbam-log-2009-12-20 (13-41-21).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 284678
Time elapsed: 2 hour(s), 24 minute(s), 14 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

A further scan of AVG showed up no new things, while all that SUPERAntiSpyware did was remove the same tracking cookies that it had previously removed. This still didn't solve my Google Chrome or IE problems. I managed to fix my Google Chrome problems by clicking on Settings -> Options -> Under the Hood -> Change proxy settings -> LAN settings -> Check "Automatically Detect Settings" (it was unchecked before). Although this fixed it, Chrome is not as fast as it should be.

When I tried doing that on IE, that checkbox was already checked. Even though both Firefox and Chrome work for me, my mom uses IE, so I would prefer it if you guys could help me. Also, my System Restore is still turned off (even though I can turn it back on) because I don't want to back up something that's bad.

Edited by supermarth64, 20 December 2009 - 08:37 PM.


BC AdBot (Login to Remove)

 


#2 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:05:31 PM

Posted 20 December 2009 - 08:39 PM

Ok , could be a few things here , First of all we will try resetting the LSP.Winsocks

download and run

Next

In Internet Explorer go to help and about and check that cipher strength says 128bit , if not let me know ,

also download spybot search and destroy install and check
Microsoft Certified Desktop Support Technician

#3 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 20 December 2009 - 08:41 PM

Also, your Malwarebytes database version is outdated. Please update it by going to the "Update" tab and then run a Full scan and post back the log.
Computer Pro

#4 supermarth64

supermarth64
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 20 December 2009 - 08:50 PM

Thanks for the quick replies. First of all:

Ok , could be a few things here , First of all we will try resetting the LSP.Winsocks

download and run

Next

In Internet Explorer go to help and about and check that cipher strength says 128bit , if not let me know ,

also download spybot search and destroy install and check

I tried running it, but it says:

Registry Import Information not Found.


The Cipher Strength says 256-bit. In the meantime, I'll run Spybot.

Also, your Malwarebytes database version is outdated. Please update it by going to the "Update" tab and then run a Full scan and post back the log.

When I first installed it yesterday, I tried to update. However, this message comes up:

An error occurred. Please report the following error to the Malwarebytes' Anti-Malware support team.

Error code: 732 (12029, 0)


Also, Dr. Web Scanner shows no viruses for the Express scan.

Edited by supermarth64, 20 December 2009 - 08:50 PM.


#5 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 20 December 2009 - 08:51 PM

Please manually download the Malwarebytes defintions from here:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe
Computer Pro

#6 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:05:31 PM

Posted 20 December 2009 - 08:54 PM

are we on windows XP or vista?
Microsoft Certified Desktop Support Technician

#7 supermarth64

supermarth64
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 20 December 2009 - 09:09 PM

Please manually download the Malwarebytes defintions from here:

http://www.malwarebytes.org/mbam/database/mbam-rules.exe


I did that and executed it, but then this error message came up:

The database you are using is not supported by this version of Malwarebytes' Anti-Malware. Download the latest version of the program.


I then went to their website, did a fresh download, and tried your step again. The same error message came up.

are we on windows XP or vista?

Vista. Didn't know that the logs didn't say that.

Edit: I also tried downloading Spybot. However, I get an error message stating:

Error sending request.

A connection with the server could not be established


Edited by supermarth64, 20 December 2009 - 09:13 PM.


#8 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:05:31 PM

Posted 20 December 2009 - 09:14 PM

ahhh Vista,
To run lsb fix you must run it as administrator you can do this by right clicking the file and clicking run as administrator , the fix should then work ,

i would recommend un-installing malware bytes all together and re installing to see if this will fix your issue

also , the virus your anti virus had found was in your System Restore please follow theese instructions to turn it off and remove the infection for good


Click Start, right-click My Computer, and then click Properties.
In the System Properties dialog box, click the System Restore tab.
Click to select the Turn off System Restore check box. Or, click to select the Turn off System Restore on all drives check box.
Click OK.
When you receive the following message, click Yes to confirm that you want to turn off System Restore:
You have chosen to turn off System Restore. If you continue, all existing restore points will be deleted, and you will not be able to track or undo changes to your computer.

Do you want to turn off System Restore?
After a few moments, the System Properties dialog box closes
Microsoft Certified Desktop Support Technician

#9 supermarth64

supermarth64
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 20 December 2009 - 09:21 PM

Didn't work, that message still pops up. However, it gave the message that it was good and to reboot it (which it isn't because I rebooted my comp after I tried that).

I tried uninstalling and reinstalling but that didn't work.

System Restore was already turned off by the virus somehow.

#10 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:05:31 PM

Posted 20 December 2009 - 09:28 PM

Last Recomendation before we start looking through a large amount of logs, Install Avast Free Edition and allow it to do an "on boot scan" stay close to the oc as it will need you to decide on what to do with the infections
Microsoft Certified Desktop Support Technician

#11 supermarth64

supermarth64
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 20 December 2009 - 09:56 PM

The scan will take too long to finish tonight, so I'll do the scan tomorrow. However, one thing to note:

When I was installing it, I had to turn automatic proxy off and set it to direct download (or direct connect, whatever) instead.

#12 supermarth64

supermarth64
  • Topic Starter

  • Members
  • 6 posts
  • OFFLINE
  •  
  • Local time:12:31 PM

Posted 20 December 2009 - 10:52 PM

Hm... that was extremely strange... I did the steps here (the reseting IE one):

http://www.bleepingcomputer.com/forums/ind...t&p=1545350

And my IE works. Also, before I did that, the Quick Tips part of ooVoo didn't work (probably because it went thorough IE). However, I reset the settings, it worked again.

Thanks for all your help anyway!

#13 MATTSPCHELP

MATTSPCHELP

  • Members
  • 196 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Leicester, United kingdom
  • Local time:05:31 PM

Posted 21 December 2009 - 12:02 AM

Ha ha , fair enough glad to have helped , i dint think that method would have helped you otherwise i would have told you
Microsoft Certified Desktop Support Technician

#14 Computer Pro

Computer Pro

  • Members
  • 2,448 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:31 AM

Posted 21 December 2009 - 11:29 AM

Now that your computer is clean you should:

Create a new Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
Go to Start > Programs > Accessories > System Tools and click "System Restore".
Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name, then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Then use Disk Cleanup to remove all but the most recently created Restore Point.
Go to Start > Run and type: Cleanmgr
Click "Ok"
Disk Cleanup will scan your files for several minutes, then open.
Click the "More Options" Tab.
Click the "Clean up" button under System Restore.
Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
Click Yes, then click Ok.
Click Yes again when prompted with "Are you sure you want to perform these actions?"
Disk Cleanup will remove the files and close automatically.
Computer Pro




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users