Page 1 of 1 [ 13 posts ] 

Madbones
Veteran
Veteran

User avatar

Joined: 7 Mar 2010
Age: 29
Gender: Male
Posts: 777
Location: In the zone

17 May 2011, 9:54 am

My freind downloaded BestAntivirus2011.exe on his laptop, he lent it me over night.
So I have been trying to fix it.
The infected files where stored in the temporary files of internet explorer. So I used CCleaner to wipe the temporary directories, because Kaspersky would not get rid of it at all.
I would press disinfect, and it did nothing. So I cleared the infected area with CCleaner. I went back to where "BestAntivirus2011.exe" was found and it was not there anymore. But when I scan with Kaspersky it says its still there.
Its not there at all. I have coupled it up to my computer and searched for the infected files and I did not find anything...
Do you think its gone? I do.
I scanned with Linux and OSX and even a Windows Machine.
Luckily, I dont think my freind launched the file.
But I cannot be sure. But thats the only thing that Kaspersky has found..
Funnily enough Malwarebytes did not pick up anything.



MCalavera
Veteran
Veteran

User avatar

Joined: 15 Dec 2010
Gender: Male
Posts: 5,442

17 May 2011, 10:13 am

Madbones wrote:
My freind downloaded BestAntivirus2011.exe on his laptop, he lent it me over night.
So I have been trying to fix it.
The infected files where stored in the temporary files of internet explorer. So I used CCleaner to wipe the temporary directories, because Kaspersky would not get rid of it at all.
I would press disinfect, and it did nothing. So I cleared the infected area with CCleaner. I went back to where "BestAntivirus2011.exe" was found and it was not there anymore. But when I scan with Kaspersky it says its still there.
Its not there at all. I have coupled it up to my computer and searched for the infected files and I did not find anything...
Do you think its gone? I do.
I scanned with Linux and OSX and even a Windows Machine.
Luckily, I dont think my freind launched the file.
But I cannot be sure. But thats the only thing that Kaspersky has found..
Funnily enough Malwarebytes did not pick up anything.


Do you know the filename and its location?

The way you're saying it, it could be just a backup file in one of the System Restore folders that need to be deleted. Did you scan again with Kaspersky to see if it still detects it?

Anyhow, if you can find a way to send me the Kaspersky scan log, that would be great.



Madbones
Veteran
Veteran

User avatar

Joined: 7 Mar 2010
Age: 29
Gender: Male
Posts: 777
Location: In the zone

17 May 2011, 10:21 am

MCalavera wrote:
Madbones wrote:
My freind downloaded BestAntivirus2011.exe on his laptop, he lent it me over night.
So I have been trying to fix it.
The infected files where stored in the temporary files of internet explorer. So I used CCleaner to wipe the temporary directories, because Kaspersky would not get rid of it at all.
I would press disinfect, and it did nothing. So I cleared the infected area with CCleaner. I went back to where "BestAntivirus2011.exe" was found and it was not there anymore. But when I scan with Kaspersky it says its still there.
Its not there at all. I have coupled it up to my computer and searched for the infected files and I did not find anything...
Do you think its gone? I do.
I scanned with Linux and OSX and even a Windows Machine.
Luckily, I dont think my freind launched the file.
But I cannot be sure. But thats the only thing that Kaspersky has found..
Funnily enough Malwarebytes did not pick up anything.


Do you know the filename and its location?

The way you're saying it, it could be just a backup file in one of the System Restore folders that need to be deleted. Did you scan again with Kaspersky to see if it still detects it?

Anyhow, if you can find a way to send me the Kaspersky scan log, that would be great.

I did do a rescan.
Its located in this COMPLETELY deleted folder.
C:/users/username/Local Settings / Microsoft/Windows/Temporary Internet Files/Low/Content.IE5/J0DD1SJO/BestAntivirus2011.exe



MCalavera
Veteran
Veteran

User avatar

Joined: 15 Dec 2010
Gender: Male
Posts: 5,442

17 May 2011, 10:25 am

Madbones wrote:
MCalavera wrote:
Madbones wrote:
My freind downloaded BestAntivirus2011.exe on his laptop, he lent it me over night.
So I have been trying to fix it.
The infected files where stored in the temporary files of internet explorer. So I used CCleaner to wipe the temporary directories, because Kaspersky would not get rid of it at all.
I would press disinfect, and it did nothing. So I cleared the infected area with CCleaner. I went back to where "BestAntivirus2011.exe" was found and it was not there anymore. But when I scan with Kaspersky it says its still there.
Its not there at all. I have coupled it up to my computer and searched for the infected files and I did not find anything...
Do you think its gone? I do.
I scanned with Linux and OSX and even a Windows Machine.
Luckily, I dont think my freind launched the file.
But I cannot be sure. But thats the only thing that Kaspersky has found..
Funnily enough Malwarebytes did not pick up anything.


Do you know the filename and its location?

The way you're saying it, it could be just a backup file in one of the System Restore folders that need to be deleted. Did you scan again with Kaspersky to see if it still detects it?

Anyhow, if you can find a way to send me the Kaspersky scan log, that would be great.

I did do a rescan.
Its located in this COMPLETELY deleted folder.
C:/users/username/Local Settings / Microsoft/Windows/Temporary Internet Files/Low/Content.IE5/J0DD1SJO/BestAntivirus2011.exe


Are all your files/folders unhidden (including system files)?

Also, if you want. Do the following with me:

Download OTL from here and save it to the desktop.

Run the program and click Quick Scan at the top.

Two Notepad files will pop up once it's done scanning. Copy/Paste the contents of both files here.

Note that if you accidentally close both Notepad files, you can locate them both on the desktop (one is OTL.txt and the other is Extras.txt)



Madbones
Veteran
Veteran

User avatar

Joined: 7 Mar 2010
Age: 29
Gender: Male
Posts: 777
Location: In the zone

17 May 2011, 10:33 am

Ok...
I have got show hidden files on..
No personal information will be shown in the logs will there?



MCalavera
Veteran
Veteran

User avatar

Joined: 15 Dec 2010
Gender: Male
Posts: 5,442

17 May 2011, 10:34 am

Madbones wrote:
Ok...
I have got show hidden files on..
No personal information will be shown in the logs will there?


Nope, unless your username folder is a personal name. If you want, we can do it via PM or even MSN. What do you think?



Madbones
Veteran
Veteran

User avatar

Joined: 7 Mar 2010
Age: 29
Gender: Male
Posts: 777
Location: In the zone

17 May 2011, 10:36 am

MCalavera wrote:
Madbones wrote:
Ok...
I have got show hidden files on..
No personal information will be shown in the logs will there?


Nope, unless your username folder is a personal name. If you want, we can do it via PM or even MSN. What do you think?

Here is fine.
I will just clear out the names.



MCalavera
Veteran
Veteran

User avatar

Joined: 15 Dec 2010
Gender: Male
Posts: 5,442

17 May 2011, 10:37 am

Madbones wrote:
MCalavera wrote:
Madbones wrote:
Ok...
I have got show hidden files on..
No personal information will be shown in the logs will there?


Nope, unless your username folder is a personal name. If you want, we can do it via PM or even MSN. What do you think?

Here is fine.
I will just clear out the names.


The folder name may be needed, though for the fix to work properly.

So I'll make sure you re-edit it back privately when you get back the fix in case there's an infection.



SilverShoelaces
Snowy Owl
Snowy Owl

User avatar

Joined: 7 Nov 2010
Age: 35
Gender: Female
Posts: 156

17 May 2011, 10:39 am

Thouh it looks like the two of you have it under control, I would also like to remind you that you should ctrl+alt+del to make sure none of the bad files are running as processes, as that makes them impossible to delete.



MCalavera
Veteran
Veteran

User avatar

Joined: 15 Dec 2010
Gender: Male
Posts: 5,442

17 May 2011, 10:40 am

SilverShoelaces wrote:
Thouh it looks like the two of you have it under control, I would also like to remind you that you should ctrl+alt+del to make sure none of the bad files are running as processes, as that makes them impossible to delete.


OTL can take care of it.



MCalavera
Veteran
Veteran

User avatar

Joined: 15 Dec 2010
Gender: Male
Posts: 5,442

17 May 2011, 11:11 am

mate, I need to get some sleep soon. If I don't hear from you within 30 min, then either get someone else to help you out if in a rush or we can continue this later/tomorrow



Fogman
Veteran
Veteran

User avatar

Joined: 19 Jun 2005
Age: 59
Gender: Male
Posts: 3,986
Location: Frå Nord Dakota til Vermont

17 May 2011, 11:47 am

You might want to follow the instructions here as well, but be forwarned, this is a guide for manual removal and you have to edit your registry by hand, so follow the instructions EXACTLY, or you could f**k your computer up.


_________________
When There's No There to get to, I'm so There!


Madbones
Veteran
Veteran

User avatar

Joined: 7 Mar 2010
Age: 29
Gender: Male
Posts: 777
Location: In the zone

17 May 2011, 11:53 am

MCalavera wrote:
mate, I need to get some sleep soon. If I don't hear from you within 30 min, then either get someone else to help you out if in a rush or we can continue this later/tomorrow

No need. Fixed the problem.