I am being invaded… by vbs:exedropper-gen[trj] and win32:ramnit-b… avast is deleting or putting them in a chest… how do I make it stop though? it is running rampant through my files… will avast be able to block them all?
Ok… it says that most were deleted or put in the chest… over 8600… but the shield tells me that those files are infected… what do I do? the pop up said I don’t need to do anything… but why does the shield still tell me that I have infected files… even when I ran a scan it showed no infections… please help… I am confused…
Next, check your computer for malware with Malwarebytes’ Anti-Malware (MBAM).
· Download freehttp://www.malwarebytes.org/ for an on-demand scanner.
· Double Click mbam-setup.exe to install the application.
· After install, click update so you have latest database before scanning.
· Under Settings:
o General: Automatically Save File After Scan Completes is checked off
o Scanner Settings: Check all boxes
o Updater: Download and install update if available is checked off
· Once the program has loaded, select “Perform FULL Scan”, then click Scan.
· The scan may take some time to finish, so please be patient.
· When the disinfection scan is complete, a log will appear in Notepad and you may be prompted to Restart. (See Extra Note).
· Click the “remove selected” button to quarantine anything found. You will find the infection details under the Quarantine tab.
· The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
· Copy & Paste the entire report in your next reply.
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts – Click OK to either and let MBAM proceed with the disinfection process; If asked to restart the computer, please do so immediately.
well, I have been home for a few hours, and I am not getting the pop ups anymore… I want to thank safesurf… I am not sure I am done yet… but I know I will forget…
so thank you for all the help so far… and if we are done… thank you!
Do you have any passwords stored on your machine? Gaming passwords or any other? If so, delete the passwords as a precaution.
Update and run another MBAM scan and if anything comes up, put them in quarantine. Copy and paste your log here in this thread.
Check the information on the first post of this thread under Virus/Worms for you to check your machine for malware: http://forum.avast.com/index.php?topic=53253.0. You already did the MBAM part. Scroll down to the red OTL and download the OTL file, which you need to download to your desktop. Follow the instructions on the link I just gave you. Attach 2 (large) OTL log files (located on your desktop) to your next post. To attach: click “Additional Options” > Attach > browse (desktop) > post (you will need to attach 2 logs to your post).
Looks like this little b*stard is a recent phenomenon.
I have exactly the same problem.
May I just say that this thread has been really helpful
BUT…for me when the trojan had finished tearing through my pc (and when the virus chest was full), I got a ‘WINDOWS FILE PROTECTION’ pop up saying that ‘programs that are required for windows to run properly have been replaced by unrecognised versions…please insert XP CD to restore the original versions’
now this didnt seem to be a problem at this stage, I just ignored the box (did not close it).
When I had finished an avast full system scan (which showed no files infected), I then went on to do a Malwarebytes scan also, as suggested in this thread.
I opened Malwarebytes, clicked on ‘update’ but there was an error and malware could not update. I then attempted to reopen firefox(with the intention of downloading malwarebytes again from scratch to get the latest definitions) but firefox would not get beyond the ‘previous session crashed’ pop up.
I then tried IE but this proceeded to start installing itself, presumably a symptom as described by the above ‘WINDOWS FILE PROTECTION’ box that appeared.
I’ve no idea what to do now :-\
I suppose I could do a malwarebytes scan without the updated definitions, but as this is a comparatively new virus I dont know how useful this will be .
Many thanks in advance for any advice you may have