possible malware here?

Three questions:

  1. Why can’t I run all the anti-spyware programs at once?
  2. Suppose A2 finds something and as you say in point #4 not to fix anything with that program directly. I assume that by posting the log file I’ll be told if there is anything there that needs to be removed and how to remove it?
  3. in point #5, when I reboot and “see if any remains of the virus”, does this mean to run the anti-spyware programs again? If so, I assume I’d not bother with A2, as it would just find what it already did prior to reboot, and since I didn’t remove anything found by A2 as directed, it’d just find it again.

Thanks

Note : OP quote deleted for an easier read - eXPerience

Hi there,

Because of several reasons

  1. your computer might become irresponsive because of all the recources the programs use
  2. the scans might interfere with each other
  3. some files will be double, if not triple detected. I’m not sure how the programs will respond, when some delete it while another is quarantining it …
2) Suppose A2 finds something and as you say in point #4 not to fix anything with that program directly. I assume that by posting the log file I'll be told if there is anything there that needs to be removed and how to remove it?
Well, the easiest way is then to rescan with A2 and to delete the files then. If you don't want to, you can delete the files manually. I'm asking for the logs because A2 is known to have a lot of False Positives.(Files that are actually needed for a stable system, deleting those could result in file loss or a complete BSOD).
3) in point #5, when I reboot and "see if any remains of the virus", does this mean to run the anti-spyware programs again? If so, I assume I'd not bother with A2, as it would just find what it already did prior to reboot, and since I didn't remove anything found by A2 as directed, it'd just find it again.

Thanks


well, the reason I’m asking this is because some applications give pop-ups etc. for example :

if those are still present that’s a sign that the virus is still there, and so we know without any scanning (= no time lose) that the system is still infected.

best regards,
eXPerience

OK- I restarted my system and there were no pop-ups. Mind you, there were no pop-ups before. I had just found some things on routine Malwarebytes and Adaware scans that wouldn’t seem to go away. Would you recommend re-running the programs you list, or is there any need at this point?

Thanks again.

It’s not needed to rerun the programs as they won’t find anything else anyway. What did they find, tracking cookies or other stuff ?
If you think you’re infected I sujest you scan with A2 and post it’s log + a hijackthis log back

best regards
eXPerience

I was just about to make a post, but the A2 log was saved as a .db3 file- I can’t attatch it or even find out what it is! Since i re-booted, A2 has to be run again in order to make a new log… 88). I’ll post the Hijack this log and add the A2 one when I have it.

I had found some things on my laptop with Adaware (TAI was 10) and Malwarebytes. I seem to remember a post (I thought it was on this site) on how to delete infections. I couldn’t find the thread, so I did what I could remember- start in safemode, use the system tools to delete all the ■■■■ it found in clean up, and re-run the anti-malware programs again. I thought it was clean until a couple days later when one of the same things having to do with the registry popped up again (sorry, can’t remember the name). This happened last time, then I remembered that the old thread said to delete all restore points. I was wondering what else i should be doing and I found this thread. So, I ran all the programs listed and didn’t find the original problem, as far as I can tell. I found other stuff though, so I’ll post it here to see if I have to do anything. I’m going to do this all on my PC as well, to see what I find.

The A2 objects can’t even be quarantined, so I assume (hope) they’re false positives.

Thanks.

[attachment deleted by admin]

Hi,

could you just change the extension from A2 to

All moved here :P0l

eXPerience

to what?

???

sorry for that, it seems my post got corrupted (again)

please change it to .txt , that’s uploadable in the forums

eXPerience

ha ha- no prob

I did make it into a text file, but when I looked at it, it didn’t have the 4 objects that A2 found- it looks totally different

I’ll post it anyway. I’m running A2 again, and it doesn’t seem to be finding those 4 items now. I initially tried to quarantine them rather than removing them as advised before I did the reboot. When I tried to quarantine them, Comodo popped up for each of them, and maybe the A2 program as well (there were a lot of things popping up :-[) saying they could not be deleted. So I figured (hoped) they were false positives. I’m a little concerned that A2 can’t find them again- it’s 3% into the deep scan and I thought they had been found by 1 or 2% the first time…

[attachment deleted by admin]

A2 didn’t find anything on the 2nd scan- does this mean those 4 objects on the 1st scan were false positives, or did I inadvertantly do something to them?

Did you scan with another product or did you reboot ?

eXPerience

I rebooted then rescanned with A2- it didn’t find anything. Do you see anything in the Hijack This file I should be concerned about? Does the A2 file make sense? Is this what it generally looks like (i.e without the found objects listed)?

Well it could be that another antimalware software required a reboot to delete those files. That could explain the detecting before and not after.

The hijackthislog seems clean

eXPerience

Thanks- I appreciate you looking at it. What about that A2 log? Is that the normal appearance? I ask because this all prompted me to do a multi-scan of my desktop computer, and while Malwarebutes and SuperantiSpyware only found cookies, A2 is finding more cookies and some medium risk registry stuff that looks alarming along with some high risk stuff. I wanted to post the A2 log when it finishes to get your opinion, but I want to make sure I post a correct log file that can be read and makes sense. Is it standard protocol to just convert the db3 file to txt after it is saved, or should I be saving it as something different? I’m wondering if the trojan I had a few weeks ago that I thought I removed is still there.

Hi,

well no, that’s not really common to change it. But that allows me to take a look at it.

looking at it
finds a corrupted file

well, can’t use it, sorry.

Could you do a scan and take a screenshot of the results (remember to expand all tabs so I can see where the files are !) ? (How to take screenshots)

eXPerience

I think a part of my issue is in the fact that before closing down A2, I tried quarantining the 4 found objects. I wasn’t allowed to, so I didn’t get a typical list of threats like I’ve seen in Adaware, etc- which I assume is the log file you’re after? The log file created by A2 that I found looks like it’s just the actions it carried out, not the files I saw it find (if this makes any sense), sort of what a Search and Destroy logfile looks like to me. I’ve never used the program before, so I don’t know how it works. If I posted the correct file, how do people upload it so that it can be read if it’s saved as a db3 file by the program? i can’t find any options on controlling the log file saves. Sorry, but this program seems to be more confusing than what it seems it should be. Maybe you and I are are talking about 2 different things, and I can’t explain myself well enough? Sorry to be a PITA…

My desktop A2 scan is still running so when it’s done I’ll do a screenshot. Are you wanting a screenshot of the A2 scan interface where it lists the objects? If so, the full list all won’t fit onto one screen shot, and the names of some are so long they need to be scrolled to see them entirely. Would I take a shot, then scroll then take another shot?

I don’t know how I messed up with the logfile/report from my laptop, but here’s the report and screenshots for my desktop A2 scan. The last 2 on drive H are safe. It’s the other ones I don’t know about. The Ultra VNC is a program a buddy put on my computer who is much more savvy than I, so I assume they’re ok too.

i happened to find a db3 file for this one too- looks like I mistook it before dor a log report that I never actually saved :-[ I have no idea now why it looks so messed up…

Here also is the Hijack This log

[attachment deleted by admin]

Hi,

I sujest you quarentine :

  • spywarebot
  • the IE plugin
  • HTML.infected
  • Trojan.generic!IK

best regards,
eXPerience