Hey, all,
Avast flashed a message up saying there was a suspect file named ‘‘Rapport Cerberus’’ in the my documents parts of my computer. Initially I thought it was just to do with the Rapport internet banking security software, so chose to ignore it. I should of deleted it as it turns out ‘‘Rapport Cerberus’’ is malware/a virus/whatever. How do I get Avast to recognise the file again, so I can delete it? I’ve tried running the boot scan, but that didn’t detect it. I’ve also ran Malwarebytes, which also came up clean. I imagine this friggin’ file is gonna cause problems if I don’t sort it, so I’d really appreciate any help 
You can always upload the file to VirusTotal to see if it’s a false positive.
Thanks, for the response.
Well, I’ve typed ‘‘Rapport Cerberus’’ into a search, and it comes up numerous times as malware or whatever, so it seems legit?
Does this mean I can still find the file? All I want is for Avast to just flash the message up again, so I have the option to delete it.
What were you doing at the time of the alert ?
If browsing it is possible that this was an alert by the Web Shield (in which case it should have stopped it getting on to your system).
- Check the avast the avastUI, Real-time Shields, Web Shield, Show report file and report the file name and full location of the detection ?
Note: change the URL from http to hXXp or www to wXw, to break the link and avoid accidental exposure to suspect sites, thanks.
If you were doing an on-demand scan at the time - Check the avast the avastUI, Scan Computer section, Scan Logs and report the file name and full location of the detection ?
Thanks.
I was just browsing, on a site I know is safe. It was an alert I’d never seen before, and it had a weird name… can’t remember it. I haven’t experienced any of the problems that appear to come with ‘‘Rapport Cerberus’’ like slowdown, being re-directed, ect. I’ve gone through everything on Avast to find it, I thought, but I’ll try all the stuff you’ve just suggested
Yeah, just tried all that stuff, but can’t seem to find anything. Surely if there’s a problem I should be able to get Avast to re-identify it, right?
There is no such thing as a safe site now, the most prevalent method of attach is through sites that have been hacked.
It ‘should’ be in the Web Shield, Show Report File that I said if it were a web shield alert, the only option is abort connection, e.g. it drops the infected items connection. See example image of the type of alert you would receive with the web shield, is that the one you saw ?
As David said above, no web site is safe.
Every 1.3 seconds a new web page is infected.
Every month almost 2 million web pages across 210,000 websites are infected with Malware.
Malware attacks have grown by more than 600% since 2008.
Have a look at this thread where a similar name was detected on another users machine, in the docs and settings folder.
Might give a pointer on where to search your own machine. Whether in fact it’s malware or not is another issue, and once file/s have been located each one can be uploaded to virus total (link is above).
Thanks, guys.
No, David, it wasn’t that kind of alert. It was the kind that was in the thread that Tarq included a link to, and it looks like the exact same file.
Do a search on the computer for the file.
You might need to show hidden and/or system files, and I’d be inclined to look in the folder shown in that alert message, first.
If you locate the file upload it to www.virustotal.com and let us know the result.
Do you know how to navigate through folders in explorer? (Windows explorer, not internet explorer.)
I’ve just been trying to search the computer, but as yet it’s bearing no fruit. I’m not sure if I know how to navigate through folders
Gmer and Malwarebytes both didn’t detect anything, which I assume they would if there was a problem?
You’re probably right.
If a scan by Avast does not reveal the file, there is probably little point in going hunting for it.
I would perform a disk cleanup,using the inbuilt utility or a program like Ccleaner to do this (if you aren’t familiar with Ccleaner, do read the help file; you can delete stuff you might not want deleted. It is safe to tick the “temp” files and “temporary internet files” boxes.)
To navigate through folders, just double click the “my computer” icon, then select the folder that you want to examine. Some are, by default, hidden.And some files within non-hidden folders are hidden. They have to be shown in “folder options” to be visible in explorer.
I use Ccleaner daily. Perhaps that already got rid of it. I have tried searching my computer but the only time the file name in question as been recognised is when I get a message with a red cross saying ‘’\Trusteer\Rapport\store\exts\RapportCerberus\19917\RapportCerberus_19917 refers to a location that is unavailable.‘’ Thanks, so much for your help, by the way.
That almost certainly means the file is no longer present.
The other possibility, and this is getting beyond my ability to help with, so I mention it only as a possibility (just in case) is that it is buried in the alternate data stream; ie: part of a rootkit.
That MBAM and Avast do not detect it would suggest this is probably not the case.
What program is producing the message with the red cross?
The red cross was just from Windows/my computer. I’ve also just ran Sophos and that came back fine 
So that red cross was in response to a search? Or something else? It didn’t just pop up there by itself.
I clicked Start, then Search, yep.
All sounds good.
All the best.