adware not-a-virus:Adware.Win32.OneStep.z?

Viruses and worms
1

I have run a scan with kaspersky. It found this (2 of them, same name) it’s not on viruslist.com

do I just disinfect? or do I take certain steps?

2

This is the saved file

32% - Scan My Computer

Scanned: 302614
Detected: 4
Untreated: 4
Start time: 17/11/2008 3:12:43 PM
Duration: 01:51:31
Finish time: 17/11/2008 8:54:12 PM
Signatures published: 16/11/2008 6:53:33 PM

Detected

Status Object

detected: adware not-a-virus:AdWare.Win32.OneStep.z File: C:\System Volume Information_restore{06099447-9FDD-4054-8CB5-1103AF8F9A72}\RP55\A0022254.exe
detected: adware not-a-virus:AdWare.Win32.OneStep.z File: C:\System Volume Information_restore{06099447-9FDD-4054-8CB5-1103AF8F9A72}\RP55\A0022255.exe
detected: malware HackTool.Win32.Sniffer.WpePro.a File: C:\System Volume Information_restore{06099447-9FDD-4054-8CB5-1103AF8F9A72}\RP85\A0049428.exe
detected: malware HackTool.Win32.Sniffer.WpePro.w File: C:\System Volume Information_restore{06099447-9FDD-4054-8CB5-1103AF8F9A72}\RP85\A0049429.dll

Events

Time Name Status Reason

17/11/2008 3:12:43 PM File: C:\System Volume Information\MountPointManagerRemoteDatabase ok iChecker
17/11/2008 3:12:43 PM File: C:\System Volume Information\tracking.log ok scanned
17/11/2008 3:12:43 PM File: C:\System Volume Information_restore{06099447-9FDD-4054-8CB5-1103AF8F9A72}\drivetable.txt ok scanned
17/11/2008 3:12:43 PM File: C:\System Volume Information_restore{06099447-9FDD-4054-8CB5-1103AF8F9A72}_driver.cfg ok scanned

Statistics

Object Scanned Detected Untreated Deleted Moved to Quarantine Archives Packed files Password protected Corrupted

Settings

Parameter Value

Security Level Recommended
Action Prompt for action when the scan is complete
Run mode Manually
File types Scan all files
Scan only new and changed files No
Scan archives All
Scan embedded OLE objects All
Skip if object is larger than No
Skip if scan takes longer than No
Parse email formats No
Scan password-protected archives No
Enable iChecker technology Yes
Enable iSwift technology Yes
Record information about dangerous objects to program statistics Yes

3

From what I see, I would de-activate System Restore which will clean out the restore points.
This would get rid of the detected problems.

Once this is done, Re-boot and then you can activate System Restore again.

4

I suggest:

  1. Clean your temporary files.
  2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  3. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
  6. Disable System Restore and then reenable it again.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.
5

Tech,
I missed one of your entries. sorry.

6
  1. Clean your temporary files.
  2. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  3. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  4. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  5. Make a HijackThis log to post here or this analysis site. Or even submit the RunScanner log to to on-line analysis.
  6. Disable System Restore and then reenable it again.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.

1.Where’s my temporary files? Do I delete all?
2.I don’t have avast ^^
3. Will any of those interfere with Kaspersky?
4. Same as 3
5. Will do (Below)
6. Done
7. Same as 3
8. Will do

You people are helpful, I just don’t understand fully ^^

7

Can you elaborate? I’m not following you…

8

The one about deleting System restore which I had mentioned in my post without this,
he is subject to possible re-infection.