I made a post before saying I thought I was infected because my computer was slowing down…
So I started up my computer and avast! says It could not update so I opening Avast! 4.8 and I got a pop up saying Malware was found. I forgot to write it down so I just looked at it in the vault for the info.
Virus: Win32 Rootkit-gen [Rtk]
Name: cfd.exe
Original Location: c:\program files\broadjump\client foundation
It said I didn’t have admin rights to access the file so I just ran avast! 4.8 as admin.
It said it was in the memory so it had to restart my computer.
It’s in the vault right now and my computers faster ^^
Does anyone know what I should do now?
Does it contain keylogger I did online bannking a few days back? :o
Is it a false positive because it said the file was changed before I got my computer!!! :-\
Any info about what it does would be greatly appreciated
Files will always be clean as they’re encrypted and Dr. Web can’t decrypt them and scan.
Into Chest, right clicking the file, you can only scan them with avast itself.
I moved the file to another location and scanned it with dr.web it said it was infected with adware.cfd
VBA32 called it adware.cfd
Bitdefender calls it adware.CFD
Mcafee called it potentially unwanted program Adware-BJCFD
Fortinet calls it Adware/BJCFD
Ikarus calls it adware.Cfd
21.88% of scanners on virus total call it malware.
It’s not enough… it’s encrypted. The results could be inacurate.
Or, on contrary, you’re saying you’ve ‘extracted’ the file from Chest and then scan it?
Disable System Restore and reenable it after step 3.
Clean your temporary files.
Schedule a boot time scanning with avast with archive scanning turned on.
Use SUPERantispyware and/or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
CFD.exe is a part of Motive usually installed by your ISP, see: http://www.neuber.com/taskmanager/process/cfd.exe.html
You can remove anything to do with Motive or Broadjump Client Foundation for that matter, while it is not needed, I think with this you have all the information you need to have,