Alright, so I have 3 computer systems (by 3 separate users, and the other 2 aren’t very tech savvy, but I am not that knowledgeable either), and I know for a fact one is infected with some form of Win32 Malware and possible more, and another one I have suspicions is infected, and then I have my system which may be infected, but I believe has the lowest possible chance of it. I will update this post as more scans are run.
Anyway, the one that I have confirmed as infected has had a boot scan, and it detected 6 infected files. 5 of them were infected with Win32:InstallBrain-F [PUP] or something to that nature and usually were on some form of uninstaller file. The other one was a different, but similar Win32 infection under the name of Win32InstallCoreE-Q [PUP]. All of these files have been successfully transferred to the virus chest, and according to that, the files were last changed on the 28th of last month, which coincides with the initial appearance of the malware according to a virustotal check I did. That also means that some havoc was probably reaped upon the system, correct? Another suspicious note that I found was that the original location of 2 of the files were under users Kyle_2 which is interesting, considering there shouldn’t be a Kyle_2 user, only a kyle. Is this a product of the malware?
EDIT: Also, looking at the virus chest, there is also a file from the 29th that was put into the virus chest within a few hours of originating, which was described as Win32:Malware Gen and also has a very strange file name. Also, all of the [PUP] registered infections were changed at the same time or within a few minutes of each other.
What I want to know is what my next plan of action should be. I am glad that Avast was able to detect the files and move them to the chest, but I presume that there is a chance that more files remain. Is it safe to delete the files already transferred to virus chest, or would that trigger some havoc? I am posting this now, and will continue updating if for the time being, in hopes of an earlier response.
In regard to the other system that I have suspicions of, the computer is mainly used by my parent’s, and I wouldn’t trust them at all with being super safe internet users. (They still use IE, even though I tell them not to…) Anyway, the whole thing started today while one of my parents was browsing the internet, and up comes one of those browser “we have found a virus, download blahblahblah” under Microsoft Security Essentials (which I don’t even think is installed) while opening up a suspicious tab and I end having the Ctrl-Alt-Delete the browser several times, as it appeared to pop-up again, or was just laggy. Then I immediately cleared the cache and ran a quick and a full scan. No infected files were found, but the scan could not scan all the files (about 20 or so) because of some encrypted password thing on the files. They were all under the administrator user, which is also the one that my parents use, and I suspect those files may be infected to some degree. I have scheduled a boot-time scan, but nothing else has been done to the system. Advice on what to do here?
And then there is the system that I use. I had another one of those “we have found a virus, blahblahblah” browser things about 5 days ago, and did the exact same thing as I posted above. I ended up doing a quick scan and a boot-scan along with clearing my cache, with no infected files found. I did the same thing 2 days later in regards to scans to the same results of no infection. I did another quick scan while typing this, and again no infection. I also have another boot-scan scheduled, in case the reason that there were no infections found earlier were due to a definition change. Advice on what to do here?
EDIT: I just saw your post Pondus. 3 of the [PUP] were on uninstall.exe type of files, 1 on a BestCodecsPack.exe (suspicious?) under downloads folder, 1 on a softonic_ssk_conduit, and the other on ICReinstall_PDFReadersetup.
EDIT: Also, no torrents or anything of that nature are used on any of these machines, if it matters in regards to origin of the possible infections, since that is how a large portion of malware is transferred to my knowledge.
