[musya]

Alright in the past week I've gotten Firefox crashing and a weird pop up from it saying performing virus scan now, and then it says your infected and it obviously seems like a fake ad.

And then today I turned on my computer and found this error message when logging in, Cannot fine

Quote

C:\Program please contact system admin....

Ive had 3 major changes recently and here they are:
1. Installed Microsoft VPC 2007
2. Installed Sun VirtualBox
3. Installed MalwareBytes and then uninstalled it

My computer had been acting a little funky since before the first even but all of these happened after the second one, and the last error message happened after all 3 of them, not sure they have anything to do with each other or not.

AVG will find some tracking cookies and warn me but I'm not sure what I'm suppose to do with them afterward? does it Automatically heal them? Delete them? Or do I need to do something about it?

Thank you,
Musya

[KYA]

Sounds like spyware!

1. Get rid of AVG
2. Install Avast
3. Verify that your downloads of VPC 2007/virtualbox is/was legit (hash check).

Malwarebytes is a great tool. However, if you have something deep, it may be "installing itself". So once you do the above, disconnect from the internet and scan, scan, scan. Avast, malware, even spybot S&D if you wanna. Clean up whatever they find. Run hijack this, research processes you don't know about. Rinse, lather, and repeat.

If you have a ring 0 rootkit, you might need to reformat, but I'd try the above first.

[musya]

I'm giving Avast a try right now, the biggest thing I don't like about most Anti-Virus's is that they slow down the computer, and AVG didn't do that so that's why I stuck with it.

I'll update you when I have something, thought the scan AVG did, seemed to clear things up too.

BTW: Why don't you like AVG? I'm just curious.

[IngeniousHax]

try using HijackThis and than google hijackthis and there is a link inwhich you can upload the file and it will tell you if it is a suspicious file, if it is, and you don't recognize it, delete it. Also, remove all the stuff you torrented recently as they may contain naughty stuff aswell.

[no2pencil]

musya, on 31 Aug, 2009 - 06:07 PM, said:

I'm giving Avast a try right now, the biggest thing I don't like about most Anti-Virus's is that they slow down the computer, and AVG didn't do that so that's why I stuck with it.

Avast does not do this.

musya, on 31 Aug, 2009 - 06:07 PM, said:

BTW: Why don't you like AVG? I'm just curious.

AVG is crap. Most of the computers that come into our shop have AVG installed, & they don't catch much in my opinion. Another selling point to Avast is that you can set it to do a pre-OS boot scan, so the virus is unable to protect itself since the PC is not booted. There is also a version of Avast available for Linux, you can scan your Windows hard drive in an external enclosure through USB. It's very nice & I've had huge success with it in my experience.

musya, on 31 Aug, 2009 - 11:33 AM, said:

Alright in the past week I've gotten Firefox crashing and a weird pop up from it saying performing virus scan now, and then it says your infected and it obviously seems like a fake ad.

KYA, on 31 Aug, 2009 - 02:37 PM, said:

Sounds like spyware!

It's Rouge Software.

When your computer has this running, see if you can find the directory under C:\program files\ that closely matches the name of the software. For example, AntiVirus 2009, MyAntiVirus, simply names like that. Usually there is just a single exe under that directory (a dead giveaway for garbage software!) & what I do is boot into recovery console, or from another machine (like described above) & then rename the exe to av.bak. Then echo "blah" > av.exe or whatever the exe name was. This way it can't re-create it, as it will check for it's existence & find it. Since it isn't running, you'll find better success in cleaning it up.

[musya]

I'll try that, I got Avast installed and it did a start up scan so all seems fine, even runs a bit smoother now. If I do get that pop up again I will look for a file like, right now I wasn't able to find it.


Thank you.

This post has been edited by musya: 31 August 2009 - 08:45 PM

[musya]

Okay well this happened again and I took screen shots of it and avast alerted me of it and closed the connection but doesn't avast delete the virus? or do you need to buy the pro version?

Anyway here are the screen shots:
http://img513.images...7240/page1z.jpg
http://img140.images...508/page2uw.jpg
http://img513.images...3548/page3b.jpg

I checked C:\\Program Files but nothing looked suspicious.

Any Ideas as to what I can do?

Thank you,
Musya

[no2pencil]

At this points they are just websites (popups), so there is no infection on your system. If you clicked anything that installed from those sites, then you would have problems. Chances are you are visiting some questionable sites, & picking this up.

[musya]

I just stick with the usual "clean" sites. Okay avast found a Trojan horse, should I delete it or move it to the chest? whats the difference?

They also close my current Firefox window and open up another tab later after the popup.

This post has been edited by musya: 04 September 2009 - 07:24 PM

[no2pencil]

I would suggest Deleting the file, rather than moving to the chest.

[DaneAU]

Personally i would be reformatting at this point. Thats just me though.

[musya]

Yea we'll see how it goes, I've been thinking of going to windows 7 when its out anyway. I'm gonna be trying it at work, so I'll see how I like it.