I found a way to remove a troujen i found ealier and deleted it. After a day, avast! detected the same virus. I deleted it moved on. Next day it was back same thing. SO now i moved it to the chest. I dont know if itll keep happening or not. PLus this troujen seems to give me an unwanted window to show up sayin i need to ‘scan my computer for a virus it detected’. Not realating to avast. Its called bestsellantivirus.com and i really hate gettin scared when this troujen keeps appearin in my temporary intenet file and to steal my valuable information on other things. I need a solution to end this unwanted troujen and this rediculous anti virus download.
If a virus is replicant (coming and coming again), you could follow the general cleaning procedure:
-
Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.
-
Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.
-
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
-
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
If any infection is detected, better and safer is send the file to Quarantine than to simple delete than. -
If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG or Panda.
-
Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.
-
After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.
-
Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.
Wow when i dowloaded and am currently usin SUPERantispyware, it detected alot of different types of adware, troujen and such. Some of these are names i know since i dowlaoded their file. How come avast doesnt do this or why isnt it functionin like its suppose to?
This sounds like scum/scam/rogue-ware, try this tool, RogueRemover, available here http://www.malwarebytes.org/rogueremover.php
SuperAntiSpyware and avast are two different program types, avast is an anti-virus and the other is anti-spyware, now avast does detect adware and spyware but it isn’t a specialist anti-spyware application. So having another program adds to your overall protection, no one program will protect against everything.
Anything found with SAS should be checked to ensure it is a good detection (see below 1) and if confirmed a sample sent to avast to improve its detections (see below 2).
-
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently over 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can’t do this with the file in quarantine/chest, you will need to move it out. -
Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.
I have a troujen file in the chest of avast! i have but when u try to use send the sample it says an error when trying to send. But overrall im happy at finding these REAL anti virus and anti spyware sites instead getting false ones. Thank you.
By the way ( sorry for double posting ) there seems to be something ‘changing’ my normal everyday advertisements on websites i know and trust to that bestsellingantivirus.com ad. Like i see a image of say eBay promoting sellin phones and other when all of a sudden it turns to a ad sayin i need to scan now it detected a virus >_>. Also after i close that page since i thought i was goin to download it, a system window that looks VERY official like what all computers use like when it cannot open a file or such. Theres the X button theres the OK button and the CANCLE button. It says it detected viruses/ adult sites that are infected. I press the X and another apeares saying its critical to scan. I press x again and it says its scanning now. I got SOO freaked about it and i end tasked it. I am very scared i dowloaded the file. I put my pop up blocker and my cookie blocker to high med and it seems to override it puttin it to minimum. Anything i can do here? By the way the window box wasnt like u can click anywere in the screen it was a real window with the buttons and such.
Hi, welcome to the forum.
Please do the first step in tech’s post, if you haven’t already done so.
Since you have downloaded superantispyware already do the followng
Open SAS, click the update button, wait for the updates to install, if you’ve already updated then procede.
Under Configuration and Preferences, click the Preferences button.
Then click the Scanning Control tab.
Under Scanner Options make sure the following are checked
- Close browsers before scanning
- Scan for tracking cookies
- Terminate memory threats before quaranine.
leave the others unchecked.
Return to the main page by clicking close on that screen. On the main screen, under Scan for Harmful Software click Scan your computer. On the left check C:\Fixed Drive.
Under Complete Scan, choose Perform Complete Scan.
· Click Next to start the scan.
When the scan is done, quarentine everthing found . Reboot if asked.
Post the log in your next reply, you can just attach it, the first log would be good too.
the log will be under Preferences, Statistics/Logs tab in the scanner logs
Click here to download HJTsetup.exe
[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
you may have to split the hijackthis log into multiple posts.
Note: you should disconnect from the internet beofre doing the scans, thanks.
hi.
you may also to try drweb cureit and do full scan of computer after fast scan is completed.
http://freedrweb.com/
you may also scan your computer with
http://www.eset.com/onlinescan/
remove folder “%systemroot%\Downloaded Program Files” that contains some ActiveX files that was installed from the internet.