What Do I Do With This Virus?

Viruses and worms
1

Hi! First, I apologize for this being long. I’m getting desperate. I’m trying to resolve this issue that I am having and have lost contact with the person who was helping me with the ticket I submitted. I will list the exchange that we had and hopefully someone can tell me what to do:

In case this might help, my ticket number was: UIV-361-40529

HAVE SUSPICIOUS RESULTS ON SCAN LOG

Please help! I need to know if the following scan log result is indicative of malware or a virus. I can’t find help anywhere. This result just began occurring yesterday and has never happened before. The results are as follows:

C:\ProgramFiles\Dell DataSafe Local Backup\Components\DSUpdate\Updates\DataSafe_TGG_Tag_ini_Update.exe|>DataSafe_Green.ico
C:\ProgramFiles\Dell DataSafe Local Backup\Components\DSUpdate\Updates\DataSafe_TGG_Tag_ini_Update.exe|>diff_000001.dif
C:\ProgramFiles\Dell DataSafe Local Backup\Components\DSUpdate\Updates\DataSafe_TGG_Tag_ini_Update.exe|>IRIMG1.BMP
C:\ProgramFiles\Dell DataSafe Local Backup\Components\DSUpdate\Updates\DataSafe_TGG_Tag_ini_Update.exe|>IRIMG1.JPG

Each one says “Error: Archive is password protected.” (42056) and there are no options available for me to take.

Also, I do not use my Dell DataSafe.

Please let me know as soon as you can! I’m very worried. If this is not a virus or malware, what is causing it?

Thank you very, very much!

AVAST TECH PERSON:

Hello,

some files may be protected or used by another running applications. This error message is usually caused when avast! is trying to scan some file which is running by some other application, or system, these files are locked from the using by anything else than the application which are running them. To scan your whole computer please ran a boot time scan.

To run the boot time scan please do following steps:

  1. Update the virus database go to avast → settings → update
  2. Schedule boot-time scan. go to avast! → Scan
  3. Restart your computer again. The boot-time scan will start - let it finish and move all the viruses found to the chest.

This should fix your issue, if not, please do not hesitate to contact me back

ME AGAIN:

Thank you for your prompt response. I did exactly as you said and there was a virus found. I sent it to the chest as instructed. These are the results:

File c:\users\Heather\AppData\LocalLow\FunwebProducts\Installr\cache\005516EB.exe|>mwssetup.zwinky.exe|>[Embedded_R#MWSOEMON.EXE] infected with PUP:win32:Mywebsearch_R [PUP]

c:\users\Heather\AppData\LocalLow\FunwebProducts\installr\cache\005516EB.exe|.mwssetup.zwinky.exe|>[Embedded_R#MWSOEPLG.DLL] infected with PUP:win32:Mywebsearch_R [PUP]

Scan Details:
Run time: 3:33:27
Tested files: 857873
Tested folders: 32008
Amount of data tested: 160.2 GB
Infected files: 10

I sent the files over the the chest. What should I do now? Thank you so much!

Okay, that’s the whole of the exchange. It’s been a couple of days and I haven’t had a response and I can no longer see my ticket. Please help! What do I do with this virus in a chest?? Thank you very much!!

2
Each one says "Error: Archive is password protected." (42056) and there are no options available for me to take.
just a scan error message .... not a detection. when avast detect malware, the file is given a malware name seems to be in some dell backup program .... and dell encrypt the backup so avast cant scan it

How do I handle files that avast! can’t scan? http://blog.avast.com/2014/02/28/how-do-i-handle-files-that-avast-cant-scan/

File c:\users\Heather\AppData\LocalLow\FunwebProducts\Installr\cache\005516EB.exe|>mwssetup.zwinky.exe|>[Embedded_R#MWSOEMON.EXE] infected with [b]PUP:win32:Mywebsearch_R [PUP][/b]

c:\users\Heather\AppData\LocalLow\FunwebProducts\installr\cache\005516EB.exe|.mwssetup.zwinky.exe|>[Embedded_R#MWSOEPLG.DLL] infected with PUP:win32:Mywebsearch_R [PUP]


PUP = not virus / Possible Unwanted Program usually crap programs that follow with freeware downloads

Malwarebytes have a good writeup here about what PUP is http://www.malwarebytes.org/pup/

Adware.MyWebSearch is a program that contains adware, installs toolbars or will display pop-up advertisements on the computer.

if you need removal help, follow instructions here https://forum.avast.com/index.php?topic=53253.0
attach Malwarebytes and OTL logs

3

Hi! What do I do with the PUP that I put in the chest? Do I leave it alone or use the given options to fix it or delete it? Thanks!!

4

there is no rush to delete from chest, files in chest can do no harm … i usually let files stay for a couple of weeks before i delete, read info in links below

Clean, Quarantine, or Delete? http://antivirus.about.com/b/2007/03/11/clean-quarantine-or-delete.htm
avast! 2014: Using the Virus Chest http://www.avast.com/faq.php?article=AVKB21#artTitle

5

Thank you very, very much for your help and info. I have been trying to resolve this for several days. I realize it must not be a huge threat or I would have heard from someone sooner, but it helps to have my worries dispelled just the same. I appreciate it!